bla-agents 0.0.0-stage → 1.5.3

package/dist/bundler/index.js

@@ -0,0 +1,167 @@
+import { SeededPrng } from "../core/prng.js";
+import { generateChaffPayloads } from "../shields/chaff/chaff-generator.js";
+import { generateHoneySourceMap } from "../shields/formats/sourcemap.js";
+import { inferJsCarrierFromPath, inferJsLoaderFromPath, transformJavaScriptWithBlaShield, } from "../shields/javascript/ast-shield.js";
+/**
+ * Infers the exact esbuild loader (`"js" | "jsx" | "ts" | "tsx"`) from a module path.
+ */
+export function inferEsbuildLoader(filePath) {
+    return inferJsLoaderFromPath(filePath);
+}
+/**
+ * Maps a Rollup/Vite output format (`"es"`, `"cjs"`, `"iife"`, `"umd"`, `"amd"`, `"system"`)
+ * or chunk filename to a BLA JavaScript carrier contract.
+ */
+export function inferCarrierFromRollupFormat(format, fileName) {
+    if (format) {
+        const normalized = format.toLowerCase().trim();
+        if (normalized === "es" ||
+            normalized === "esm" ||
+            normalized === "module") {
+            return "module";
+        }
+        if (normalized === "cjs" || normalized === "commonjs") {
+            return "commonjs";
+        }
+        if (normalized === "iife" ||
+            normalized === "umd" ||
+            normalized === "amd" ||
+            normalized === "system") {
+            return "script";
+        }
+    }
+    return inferJsCarrierFromPath(fileName);
+}
+/**
+ * Vite & Rollup plugin (`blaVitePlugin` / `blaRollupPlugin`) that automatically
+ * injects BLA's three-stage adversarial shield into generated JS chunks during `renderChunk`.
+ *
+ * Usage in `vite.config.ts`:
+ * ```ts
+ * import { defineConfig } from "vite";
+ * import { blaVitePlugin } from "bla-shield";
+ *
+ * export default defineConfig({
+ *   plugins: [blaVitePlugin({ intensity: "bankrupt" })],
+ * });
+ * ```
+ */
+export function blaRollupPlugin(options = {}) {
+    const intensity = options.intensity ?? "balanced";
+    const include = options.include ?? /\.(?:m?js|cjs)$/i;
+    const emitMap = options.honeySourceMap ?? true;
+    return {
+        name: "bla-shield-rollup-plugin",
+        renderChunk(code, chunk, outputOptions) {
+            if (!include.test(chunk.fileName)) {
+                return null;
+            }
+            const seed = `${options.seed ?? "bla-rollup"}:${chunk.fileName}`;
+            const sourceType = inferCarrierFromRollupFormat(outputOptions?.format, chunk.fileName);
+            const loader = inferEsbuildLoader(chunk.fileName);
+            const transformed = transformJavaScriptWithBlaShield(code, {
+                intensity,
+                seed,
+                filename: chunk.fileName,
+                sourceType,
+                loader,
+            });
+            if (!emitMap) {
+                return { code: transformed.code, map: null };
+            }
+            const prng = new SeededPrng(seed);
+            const chaff = generateChaffPayloads(prng, intensity);
+            const lineCount = transformed.code.split("\n").length;
+            const honeyMap = generateHoneySourceMap(chunk.fileName, lineCount, prng, chaff);
+            return {
+                code: transformed.code,
+                map: honeyMap.mapObject,
+            };
+        },
+    };
+}
+/**
+ * Alias of `blaRollupPlugin` with `enforce: "post"` for Vite 4/5/6.
+ */
+export function blaVitePlugin(options = {}) {
+    return {
+        ...blaRollupPlugin(options),
+        name: "vite-plugin-bla-shield",
+        enforce: "post",
+    };
+}
+/**
+ * Webpack 5 / Rspack plugin class (`BlaWebpackPlugin`) that shields emitted JS assets.
+ */
+export class BlaWebpackPlugin {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    apply(compiler) {
+        const intensity = this.options.intensity ?? "balanced";
+        const include = this.options.include ?? /\.(?:m?js|cjs)$/i;
+        compiler.hooks.compilation.tap("BlaWebpackPlugin", (compilation) => {
+            compilation.hooks.processAssets.tap({
+                name: "BlaWebpackPlugin",
+                stage: 400, // PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE
+            }, (assets) => {
+                for (const assetName of Object.keys(assets)) {
+                    if (!include.test(assetName))
+                        continue;
+                    const rawAsset = assets[assetName];
+                    if (!rawAsset)
+                        continue;
+                    const rawSource = rawAsset.source().toString("utf8");
+                    const sourceType = inferJsCarrierFromPath(assetName);
+                    const loader = inferEsbuildLoader(assetName);
+                    const transformed = transformJavaScriptWithBlaShield(rawSource, {
+                        intensity,
+                        seed: `${this.options.seed ?? "bla-webpack"}:${assetName}`,
+                        filename: assetName,
+                        sourceType,
+                        loader,
+                    });
+                    const shieldedCode = transformed.code;
+                    compilation.updateAsset(assetName, {
+                        source: () => shieldedCode,
+                        size: () => Buffer.byteLength(shieldedCode, "utf8"),
+                    });
+                }
+            });
+        });
+    }
+}
+/**
+ * esbuild plugin (`blaEsbuildPlugin`) that shields JS/TS/JSX/TSX entrypoints or modules
+ * while preserving the exact esbuild loader (`js`, `jsx`, `ts`, `tsx`) and module carrier.
+ */
+export function blaEsbuildPlugin(options = {}) {
+    const intensity = options.intensity ?? "balanced";
+    const include = options.include ?? /\.(?:[cm]?[jt]sx?)$/i;
+    return {
+        name: "bla-shield-esbuild-plugin",
+        setup(build) {
+            build.onLoad({ filter: include }, async (args) => {
+                if (args.path.includes("node_modules"))
+                    return null;
+                const fs = await import("node:fs/promises");
+                const source = await fs.readFile(args.path, "utf8");
+                const loader = inferEsbuildLoader(args.path);
+                const sourceType = inferJsCarrierFromPath(args.path);
+                const transformed = transformJavaScriptWithBlaShield(source, {
+                    intensity,
+                    seed: `${options.seed ?? "bla-esbuild"}:${args.path}`,
+                    filename: args.path,
+                    loader,
+                    sourceType,
+                });
+                return {
+                    contents: transformed.code,
+                    loader,
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/bundler/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bundler/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gCAAgC,GAGjC,MAAM,qCAAqC,CAAC;AAa7C;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAe,EACf,QAAiB;IAEjB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/C,IACE,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,KAAK;YACpB,UAAU,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YACtD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IACE,UAAU,KAAK,MAAM;YACrB,UAAU,KAAK,KAAK;YACpB,UAAU,KAAK,KAAK;YACpB,UAAU,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,UAAmC,EAAE;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,WAAW,CACT,IAAY,EACZ,KAA8C,EAC9C,aAAmC;YAEnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,4BAA4B,CAC7C,aAAa,EAAE,MAAM,EACrB,KAAK,CAAC,QAAQ,CACf,CAAC;YACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,EAAE;gBACzD,SAAS;gBACT,IAAI;gBACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU;gBACV,MAAM;aACP,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACtD,MAAM,QAAQ,GAAG,sBAAsB,CACrC,KAAK,CAAC,QAAQ,EACd,SAAS,EACT,IAAI,EACJ,KAAK,CACN,CAAC;YAEF,OAAO;gBACL,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,GAAG,EAAE,QAAQ,CAAC,SAAS;aACxB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAAmC,EAAE;IACjE,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,MAAe;KACzB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAA0B;IAE1C,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QA2BL;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;QAE3D,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE;YACjE,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CACjC;gBACE,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,GAAG,EAAE,uCAAuC;aACpD,EACD,CAAC,MAAM,EAAE,EAAE;gBACT,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;wBAAE,SAAS;oBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;oBACnC,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACrD,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;oBACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;oBAC7C,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,EAAE;wBAC9D,SAAS;wBACT,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,aAAa,IAAI,SAAS,EAAE;wBAC1D,QAAQ,EAAE,SAAS;wBACnB,UAAU;wBACV,MAAM;qBACP,CAAC,CAAC;oBACH,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC;oBACtC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE;wBACjC,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY;wBAC1B,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC;qBACpD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,KAOL;YACC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACpD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7C,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,WAAW,GAAG,gCAAgC,CAAC,MAAM,EAAE;oBAC3D,SAAS;oBACT,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE;oBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM;oBACN,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO;oBACL,QAAQ,EAAE,WAAW,CAAC,IAAI;oBAC1B,MAAM;iBACP,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import type { ProtectionIntensity } from "./core/types.js";
+import { type NativeHeaderLanguage } from "./shields/formats/headers.js";
+import { type SupportedAgentClientId } from "./setup/clients.js";
+interface ParsedCliArgs {
+    readonly command: string;
+    readonly positionals: string[];
+    readonly output?: string;
+    readonly configPath?: string;
+    readonly inPlace: boolean;
+    readonly intensity: ProtectionIntensity;
+    readonly seed?: string;
+    readonly manifest: boolean;
+    readonly llmDirectives: boolean;
+    readonly lang: NativeHeaderLanguage;
+    readonly clients: SupportedAgentClientId[];
+    readonly allDetected: boolean;
+    readonly dryRun: boolean;
+    readonly yes: boolean;
+    readonly json: boolean;
+    readonly sarif: boolean;
+    readonly failUnder?: number;
+    readonly honeyMaps: boolean;
+    readonly help: boolean;
+    readonly version: boolean;
+}
+export declare function parseCliArgs(argv: readonly string[]): ParsedCliArgs;
+export declare function runCli(argv?: readonly string[]): Promise<number>;
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAO3D,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AA8DjE,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAmGnE;AAED,wBAAsB,MAAM,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAwP7F"}

package/dist/cli.js

@@ -0,0 +1,447 @@
+#!/usr/bin/env node
+import { writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { BLA_IDENTITY } from "./identity.js";
+import { initBlaConfig, loadBlaConfig, resolveProjectSeed } from "./core/config.js";
+import { inspectReleaseExposure } from "./core/release-exposure.js";
+import { buildSarifReport } from "./core/sarif.js";
+import { auditTarget } from "./engine/auditor.js";
+import { protectTarget } from "./engine/protector.js";
+import { verifyTarget } from "./engine/verifier.js";
+import { defendTarget } from "./engine/defender.js";
+import { formatHardenProjectReport, hardenProject } from "./engine/harden.js";
+import { runShowcaseBenchmark } from "./engine/benchmark.js";
+import { emitCompileTimeNativeHeader, } from "./shields/formats/headers.js";
+import { runSetup, runUninstall } from "./setup/setup.js";
+import { runDoctor } from "./setup/doctor.js";
+import { startMcpStdioServer } from "./mcp/server.js";
+import { formatAuditReport, formatBanner, formatBenchmarkReport, formatDoctorReport, formatOneClickDefenseReport, formatProtectionResult, formatSetupReport, formatVerificationReport, } from "./ui/reporter.js";
+function printHelp() {
+    console.log(`${formatBanner()}
+
+Usage:
+  npx bla-agents <command> [options]
+  npx bla-shield <command> [options]
+  bla <command> [options]
+
+Quick start:
+  npx bla-agents setup -y          # register bla_harden with your agent
+  bla harden .                     # one-sentence Counter-REA hardening
+  # or tell your agent: "Harden my software against REA"
+
+Commands:
+  setup                       Configure agent MCP integrations & install the BLA skill
+  harden [dir]                DEFAULT: auto-discover build outputs under a project/build dir and bankrupt-harden all of them
+  defend <target>             One-click full Counter-REA pipeline (inspect -> audit -> bankrupt protect -> verify)
+  inspect-release <target>    Read-only local source-map & symbol exposure check
+  audit <target>              Pre-flight REA exposure & vulnerability scan
+  protect <target>            Inject multi-layer Counter-REA adversarial shield
+  verify <target> [original]  Verify Counter-REA defense invariants & token amplification
+  benchmark                   Run the 14-target Counter-REA Showcase Benchmark suite
+  emit-headers                Generate compile-time C/C++, Rust, or Go defense headers
+  doctor                      Check readiness of BLA engines & agent registrations
+  update                      Update global bla-shield installation & print setup refresh instructions
+  uninstall                   Remove BLA MCP configuration & skill files
+  mcp                         Start the BLA Model Context Protocol (MCP) server over stdio
+
+Options:
+  -o, --output <path>         Output file or directory path (for protect / emit-headers)
+  --in-place                  Overwrite input target in-place (for protect)
+  --intensity <preset>        stealth | balanced | maximum | bankrupt
+                            (harden/defend default: bankrupt; protect default: balanced)
+  --seed <seed>               Deterministic PRNG seed (default: per-project random in .blarc)
+  --manifest                  Emit unsigned .bla-manifest.json next to protected artifacts (opt-in)
+  --llm-directives            Opt-in risky LLM directive layers (COPPA/medical bait, dual-use imitation, AI chat markers); OFF by default
+  --lang <c|rust|go>          Target language for emit-headers (default: c)
+  --client <id>               Agent client ID for setup (repeatable: claude_code, cursor, codex, etc.)
+  --all-detected              Configure all detected coding agents on this machine
+  --dry-run                   Preview planned setup changes without writing files
+  -y, --yes                   Approve setup actions without interactive confirmation
+  --json                      Emit structured JSON output
+  -v, --version               Print BLA version
+  -h, --help                  Print this help guide
+`);
+}
+export function parseCliArgs(argv) {
+    let command = "";
+    const positionals = [];
+    let output;
+    let configPath;
+    let inPlace = false;
+    let intensity = "balanced";
+    let seed;
+    let manifest = false;
+    let llmDirectives = false;
+    let lang = "c";
+    const clients = [];
+    let allDetected = false;
+    let dryRun = false;
+    let yes = false;
+    let json = false;
+    let sarif = false;
+    let failUnder;
+    let honeyMaps = true;
+    let help = false;
+    let version = false;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "-h" || arg === "--help") {
+            help = true;
+        }
+        else if (arg === "-v" || arg === "--version") {
+            version = true;
+        }
+        else if (arg === "--json") {
+            json = true;
+        }
+        else if (arg === "--sarif") {
+            sarif = true;
+        }
+        else if (arg === "-y" || arg === "--yes") {
+            yes = true;
+        }
+        else if (arg === "--dry-run") {
+            dryRun = true;
+        }
+        else if (arg === "--all-detected") {
+            allDetected = true;
+        }
+        else if (arg === "--in-place") {
+            inPlace = true;
+        }
+        else if (arg === "--no-honey-maps") {
+            honeyMaps = false;
+        }
+        else if (arg === "--manifest") {
+            manifest = true;
+        }
+        else if (arg === "--llm-directives") {
+            llmDirectives = true;
+        }
+        else if (arg === "--mcp") {
+            command = "mcp";
+        }
+        else if (arg === "--update") {
+            command = "update";
+        }
+        else if ((arg === "-o" || arg === "--output") && i + 1 < argv.length) {
+            output = argv[++i];
+        }
+        else if ((arg === "-c" || arg === "--config") && i + 1 < argv.length) {
+            configPath = argv[++i];
+        }
+        else if (arg === "--fail-under" && i + 1 < argv.length) {
+            const n = Number(argv[++i]);
+            if (Number.isFinite(n))
+                failUnder = n;
+        }
+        else if (arg === "--intensity" && i + 1 < argv.length) {
+            const val = argv[++i];
+            if (["stealth", "balanced", "maximum", "bankrupt"].includes(val)) {
+                intensity = val;
+            }
+        }
+        else if (arg === "--seed" && i + 1 < argv.length) {
+            seed = argv[++i];
+        }
+        else if (arg === "--lang" && i + 1 < argv.length) {
+            const val = argv[++i];
+            if (["c", "rust", "go"].includes(val)) {
+                lang = val;
+            }
+        }
+        else if (arg === "--client" && i + 1 < argv.length) {
+            clients.push(argv[++i]);
+        }
+        else if (!arg.startsWith("-")) {
+            if (!command)
+                command = arg;
+            else
+                positionals.push(arg);
+        }
+    }
+    return {
+        command,
+        positionals,
+        ...(output !== undefined ? { output } : {}),
+        ...(configPath !== undefined ? { configPath } : {}),
+        inPlace,
+        intensity,
+        ...(seed !== undefined ? { seed } : {}),
+        manifest,
+        llmDirectives,
+        lang,
+        clients,
+        allDetected,
+        dryRun,
+        yes,
+        json,
+        sarif,
+        ...(failUnder !== undefined ? { failUnder } : {}),
+        honeyMaps,
+        help,
+        version,
+    };
+}
+export async function runCli(argv = process.argv.slice(2)) {
+    const parsed = parseCliArgs(argv);
+    if (parsed.version) {
+        console.log(BLA_IDENTITY.version);
+        return 0;
+    }
+    if (parsed.command === "mcp") {
+        startMcpStdioServer();
+        return 0;
+    }
+    if (parsed.help || !parsed.command) {
+        printHelp();
+        return 0;
+    }
+    try {
+        switch (parsed.command) {
+            case "setup": {
+                const res = runSetup({
+                    ...(parsed.clients.length > 0 ? { clientIds: parsed.clients } : {}),
+                    allDetected: parsed.allDetected,
+                    dryRun: parsed.dryRun,
+                    yes: parsed.yes,
+                });
+                if (parsed.json)
+                    console.log(JSON.stringify(res, null, 2));
+                else
+                    console.log(formatSetupReport(res));
+                return 0;
+            }
+            case "doctor": {
+                const doc = runDoctor();
+                if (parsed.json)
+                    console.log(JSON.stringify(doc, null, 2));
+                else
+                    console.log(formatDoctorReport(doc));
+                return doc.healthy ? 0 : 1;
+            }
+            case "update": {
+                const updateInfo = {
+                    currentVersion: BLA_IDENTITY.version,
+                    package: BLA_IDENTITY.packageName,
+                    packageAlias: BLA_IDENTITY.packageAlias,
+                    refreshSetupCommand: "npx bla-agents@latest setup",
+                    globalUpdateCommand: "npm install --global bla-agents@latest",
+                };
+                if (parsed.json) {
+                    console.log(JSON.stringify(updateInfo, null, 2));
+                }
+                else {
+                    console.log(`${formatBanner()}\n\nBLA v${BLA_IDENTITY.version} update workflow:\n  • Global CLI update:   npm install --global bla-agents@latest\n  • Agent MCP refresh:   npx bla-agents@latest setup\n`);
+                }
+                return 0;
+            }
+            case "uninstall": {
+                const res = runUninstall();
+                if (parsed.json)
+                    console.log(JSON.stringify(res, null, 2));
+                else
+                    console.log(`Removed BLA configuration from ${res.removedClients.length} client(s).`);
+                return 0;
+            }
+            case "init": {
+                const dir = parsed.positionals[0] ?? process.cwd();
+                const res = initBlaConfig(dir, parsed.inPlace);
+                if (parsed.json) {
+                    console.log(JSON.stringify(res, null, 2));
+                }
+                else {
+                    console.log(res.created
+                        ? `Created ${res.configPath} (default input: "${res.config.input}", intensity: "${res.config.intensity}").`
+                        : `Config already exists at ${res.configPath}. Pass --in-place to overwrite.`);
+                }
+                return 0;
+            }
+            case "inspect-release": {
+                const target = parsed.positionals[0];
+                if (!target) {
+                    console.error("Error: Missing <target> path for `bla inspect-release <target>`.");
+                    return 1;
+                }
+                const report = inspectReleaseExposure(target);
+                console.log(JSON.stringify(report, null, 2));
+                return report.status === "complete" ? 0 : 2;
+            }
+            case "harden": {
+                const loaded = loadBlaConfig(process.cwd(), parsed.configPath);
+                const directory = parsed.positionals[0] ?? loaded.config.input ?? process.cwd();
+                const explicitIntensity = argv.includes("--intensity")
+                    ? parsed.intensity
+                    : (loaded.config.intensity ?? "bankrupt");
+                const resolved = resolveProjectSeed(typeof directory === "string" ? directory : process.cwd(), parsed.seed, parsed.configPath);
+                const report = hardenProject({
+                    directory,
+                    intensity: explicitIntensity,
+                    seed: resolved.seed,
+                    emitManifest: parsed.manifest || loaded.config.emitManifest === true,
+                    llmDirectives: parsed.llmDirectives || loaded.config.llmDirectives === true,
+                    ...(parsed.output !== undefined ? { outputDirectory: parsed.output } : {}),
+                });
+                if (parsed.json) {
+                    console.log(JSON.stringify(report, null, 2));
+                }
+                else {
+                    console.log(formatHardenProjectReport(report));
+                }
+                return report.overallSuccess || report.discoveredCount === 0 ? (report.discoveredCount === 0 ? 2 : 0) : 2;
+            }
+            case "defend": {
+                const loaded = loadBlaConfig(process.cwd(), parsed.configPath);
+                const target = parsed.positionals[0] ?? loaded.config.input;
+                if (!target) {
+                    console.error("Error: Missing <target> path for `bla defend <target>`.");
+                    return 1;
+                }
+                const explicitIntensity = argv.includes("--intensity")
+                    ? parsed.intensity
+                    : (loaded.config.intensity ?? "bankrupt");
+                const resolved = resolveProjectSeed(process.cwd(), parsed.seed, parsed.configPath);
+                const report = defendTarget({
+                    inputPath: target,
+                    ...((parsed.output ?? loaded.config.output) !== undefined
+                        ? { outputPath: (parsed.output ?? loaded.config.output) }
+                        : {}),
+                    inPlace: parsed.inPlace,
+                    intensity: explicitIntensity,
+                    seed: resolved.seed,
+                    emitManifest: parsed.manifest || loaded.config.emitManifest === true,
+                    llmDirectives: parsed.llmDirectives || loaded.config.llmDirectives === true,
+                });
+                if (parsed.sarif) {
+                    console.log(JSON.stringify(buildSarifReport(report.beforeAudit, report.releaseExposure), null, 2));
+                }
+                else if (parsed.json) {
+                    console.log(JSON.stringify(report, null, 2));
+                }
+                else {
+                    console.log(formatOneClickDefenseReport(report));
+                }
+                const threshold = parsed.failUnder ?? loaded.config.minDefenseScore;
+                if (threshold !== undefined && report.verification.defenseScore < threshold) {
+                    return 2;
+                }
+                return report.overallSuccess ? 0 : 2;
+            }
+            case "audit": {
+                const loaded = loadBlaConfig(process.cwd(), parsed.configPath);
+                const target = parsed.positionals[0] ?? loaded.config.input;
+                if (!target) {
+                    console.error("Error: Missing <target> path for `bla audit <target>`.");
+                    return 1;
+                }
+                const report = auditTarget(target);
+                if (parsed.sarif) {
+                    console.log(JSON.stringify(buildSarifReport(report), null, 2));
+                }
+                else if (parsed.json) {
+                    console.log(JSON.stringify(report, null, 2));
+                }
+                else {
+                    console.log(formatAuditReport(report));
+                }
+                return 0;
+            }
+            case "protect": {
+                const loaded = loadBlaConfig(process.cwd(), parsed.configPath);
+                const target = parsed.positionals[0] ?? loaded.config.input;
+                if (!target) {
+                    console.error("Error: Missing <target> path for `bla protect <target>`.");
+                    return 1;
+                }
+                const resolved = resolveProjectSeed(process.cwd(), parsed.seed, parsed.configPath);
+                const res = protectTarget({
+                    inputPath: target,
+                    ...((parsed.output ?? loaded.config.output) !== undefined
+                        ? { outputPath: (parsed.output ?? loaded.config.output) }
+                        : {}),
+                    inPlace: parsed.inPlace,
+                    intensity: argv.includes("--intensity")
+                        ? parsed.intensity
+                        : (loaded.config.intensity ?? parsed.intensity),
+                    seed: resolved.seed,
+                    honeySourceMaps: parsed.honeyMaps,
+                    llmDirectives: parsed.llmDirectives || loaded.config.llmDirectives === true,
+                });
+                if (parsed.json)
+                    console.log(JSON.stringify(res, null, 2));
+                else
+                    console.log(formatProtectionResult(res));
+                return 0;
+            }
+            case "verify": {
+                const target = parsed.positionals[0];
+                if (!target) {
+                    console.error("Error: Missing <target> path for `bla verify <target> [original]`.");
+                    return 1;
+                }
+                const report = verifyTarget(target, parsed.positionals[1]);
+                if (parsed.json)
+                    console.log(JSON.stringify(report, null, 2));
+                else
+                    console.log(formatVerificationReport(report));
+                if (parsed.failUnder !== undefined && report.defenseScore < parsed.failUnder) {
+                    return 2;
+                }
+                return report.overallPassed ? 0 : 2;
+            }
+            case "benchmark": {
+                const bench = await runShowcaseBenchmark();
+                if (parsed.json)
+                    console.log(JSON.stringify(bench, null, 2));
+                else
+                    console.log(formatBenchmarkReport(bench));
+                return 0;
+            }
+            case "emit-headers": {
+                const emitted = emitCompileTimeNativeHeader(parsed.lang, {
+                    intensity: parsed.intensity,
+                    ...(parsed.seed !== undefined ? { seed: parsed.seed } : {}),
+                });
+                if (parsed.output) {
+                    const outPath = resolve(parsed.output);
+                    writeFileSync(outPath, emitted.content, "utf8");
+                    if (parsed.json) {
+                        console.log(JSON.stringify({ ...emitted, outputPath: outPath }, null, 2));
+                    }
+                    else {
+                        console.log(`Emitted ${emitted.language.toUpperCase()} defense header to ${outPath} (${emitted.decoyFunctionsCount} decoy tarpit functions).`);
+                    }
+                }
+                else if (parsed.json) {
+                    console.log(JSON.stringify(emitted, null, 2));
+                }
+                else {
+                    console.log(emitted.content);
+                }
+                return 0;
+            }
+            default:
+                console.error(`Unknown command: ${parsed.command}. Run "bla --help" for available commands.`);
+                return 1;
+        }
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+}
+// Run when invoked directly
+const isDirectExecution = process.argv[1] !== undefined &&
+    (process.argv[1].endsWith("cli.js") ||
+        process.argv[1].endsWith("cli.ts") ||
+        process.argv[1].endsWith("bla") ||
+        process.argv[1].endsWith("bla-agents") ||
+        process.argv[1].endsWith("bla-shield"));
+if (isDirectExecution) {
+    runCli().then((code) => {
+        if (process.argv[2] !== "mcp" && !process.argv.includes("--mcp")) {
+            process.exitCode = code;
+        }
+    });
+}
+//# sourceMappingURL=cli.js.map