blindseal 0.5.0 → 0.5.1

package/fixtures/policy.json

@@ -0,0 +1,216 @@
+{
+  "root": "0x36a9e9457db6ecfd752a379fc9279ad6a0acfea07928f61e2f3638a685c38397",
+  "version": 2,
+  "updatedAt": "2026-10-20T09:00:01.026Z",
+  "detectorVersion": "0x726faa56c0857bbace50727feedf504a76f37a98c975f565e44bf341fb29851d",
+  "leafCount": 23,
+  "parameters": {
+    "zeroWidthDensityThreshold": 0.1
+  },
+  "l0Decoders": [
+    "base64-decoded-run",
+    "hex-decoded-run",
+    "url-decoded-run",
+    "html-entity-decoded-run"
+  ],
+  "rules": [
+    {
+      "id": "unicode-tag-smuggling",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "unicode-tag-smuggling",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "bidi-override-smuggling",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "bidi-override-smuggling",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "html-entity-encoded-run",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "html-entity-encoded-run",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "instruction-prefix:ignore-previous",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "instruction-prefix:ignore-previous",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "instruction-prefix:disregard-above",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "instruction-prefix:disregard-above",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "instruction-prefix:forget-previous",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "instruction-prefix:forget-previous",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "instruction-prefix:system-prefix",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "instruction-prefix:system-prefix",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "instruction-prefix:you-are-now",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "instruction-prefix:you-are-now",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "instruction-prefix:new-instructions",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "instruction-prefix:new-instructions",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "instruction-prefix:override-above",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "instruction-prefix:override-above",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "html-comment-injection",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "html-comment-injection",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "markdown-link-prompt-anchor",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "markdown-link-prompt-anchor",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "large-base64-blob",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "large-base64-blob",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "bracket-ai-directive",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "bracket-ai-directive",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "refusal-suppression-directive",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "refusal-suppression-directive",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "memory-store-injection",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "memory-store-injection",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "pipeline-authority-claim",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "pipeline-authority-claim",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "sleeper-trigger-setup",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "sleeper-trigger-setup",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "recursive-output-injection",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "recursive-output-injection",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "dan-dual-label",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "dan-dual-label",
+      "severity": "Malicious",
+      "verdict": "block",
+      "enabled": true
+    },
+    {
+      "id": "affirmative-prefix-elicitation",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "affirmative-prefix-elicitation",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    },
+    {
+      "id": "task-reassignment-directive",
+      "layer": "L1",
+      "kind": "dfa",
+      "name": "task-reassignment-directive",
+      "severity": "Suspicious",
+      "verdict": "flag",
+      "enabled": true
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blindseal",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Blindseal — a local MCP proxy that screens every tool call (four detection layers), redacts before the model-based layers, keeps a hash-chained audit log, and produces zero-knowledge attestations verifiable on Solana.",
   "license": "MIT",
   "homepage": "https://blindseal.tech",
@@ -15,11 +15,12 @@
   "bin": {
     "blindseal": "dist/index.js",
     "blindseal-audit": "dist/audit-view.js",
-    "blindseal-init": "dist/init.js",
     "blindseal-decide": "dist/decide.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "dashboard",
+    "fixtures"
   ],
   "dependencies": {
     "@anthropic-ai/sdk": "^0.32.0",
@@ -27,7 +28,7 @@
     "@solana/web3.js": "1.98.0",
     "@xenova/transformers": "^2.17.2",
     "better-sqlite3": "^12.10.0",
-    "blindseal-verifier-wasm": "0.5.0"
+    "blindseal-verifier-wasm": "0.5.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
@@ -36,11 +37,11 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@blindseal/redactor": "0.0.1",
     "@blindseal/corpus": "0.0.1",
     "@blindseal/audit": "0.0.1",
+    "@blindseal/redactor": "0.0.1",
     "@blindseal/chain-reads": "0.0.0",
-    "blindseal-sdk": "0.5.0"
+    "blindseal-sdk": "0.5.1"
   },
   "keywords": [
     "mcp",
@@ -58,10 +59,9 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node scripts/bundle-assets.mjs",
     "dev": "tsx src/index.ts",
     "view-audit": "tsx src/cli/audit-view.ts",
-    "init": "tsx src/cli/init.ts",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
     "bench:l3": "tsx bench/layer3-floor.ts"

package/dist/attest-QLIE2OSQ.js

@@ -1,195 +0,0 @@
-#!/usr/bin/env node
-import {
-  makeLayer0Result,
-  runLayer0,
-  runLayer1
-} from "./chunk-XV57KLEO.js";
-import {
-  openAudit
-} from "./chunk-PQ457W6T.js";
-import "./chunk-PDX44BCA.js";
-
-// src/cli/attest.ts
-import { createHash, randomBytes } from "crypto";
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { spawnSync } from "child_process";
-import os from "os";
-import path from "path";
-
-// src/chain/solana.ts
-var CHAIN_ID_SOLANA_MAINNET = 1;
-var SYSTEM_PROGRAM = "11111111111111111111111111111111";
-var TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
-var RECIPIENT_KEYS = ["recipient", "to", "destination", "dest", "receiver", "toPubkey", "toAddress"];
-var AMOUNT_KEYS = ["amount", "lamports", "value", "tokenAmount", "quantity"];
-var MINT_KEYS = ["mint", "token", "tokenMint", "mintAddress"];
-var AUTHORITY_KEYS = ["authority", "owner", "from", "source", "payer", "fromPubkey", "signer"];
-var PROGRAM_KEYS = ["program", "programId", "programAddress"];
-var TRANSFER_TOOL = /(?:^|_|\b)(?:transfer|send|pay|spl[_-]?transfer|transfer[_-]?checked)(?:_|\b|$)/i;
-function firstString(obj, keys) {
-  for (const k of keys) {
-    const v = obj[k];
-    if (typeof v === "string" && v.length > 0) return v;
-    if (typeof v === "number" && Number.isFinite(v)) return String(v);
-    if (typeof v === "bigint") return v.toString();
-  }
-  return void 0;
-}
-function parseSolanaAction(toolName, args, opts = {}) {
-  if (!args || typeof args !== "object") return null;
-  const a = args;
-  const amount = firstString(a, AMOUNT_KEYS);
-  const recipient = firstString(a, RECIPIENT_KEYS);
-  const explicitProgram = firstString(a, PROGRAM_KEYS);
-  const looksLikeTransfer = TRANSFER_TOOL.test(toolName);
-  if (!looksLikeTransfer && !explicitProgram) return null;
-  if (recipient === void 0 && amount === void 0 && explicitProgram === void 0) return null;
-  const mint = firstString(a, MINT_KEYS);
-  const sourceAuthority = firstString(a, AUTHORITY_KEYS);
-  void opts;
-  const chainId = CHAIN_ID_SOLANA_MAINNET;
-  const targetProgram = explicitProgram ?? (mint ? TOKEN_PROGRAM : SYSTEM_PROGRAM);
-  const instruction = typeof a.instruction === "string" && a.instruction || typeof a.method === "string" && a.method || (mint ? "transferChecked" : "transfer");
-  return {
-    chain: "solana",
-    chainId,
-    targetProgram,
-    instruction,
-    recipient: recipient ?? "",
-    mint: mint ?? "",
-    amount: amount ?? "",
-    sourceAuthority: sourceAuthority ?? ""
-  };
-}
-
-// src/cli/attest.ts
-var HELP = `blindseal attest \u2014 screen a tool call, record the decision, prove it
-
-Usage:
-  blindseal attest <toolcall.json> --out <attestation.json> --target-program <program id> [flags]
-
-Flags
-  --out <file>               where to write attestation.json (default ./attestation.json)
-  --target-program <id>      the gated program the action targets (base58)
-  --instruction <16 hex>     instruction discriminator (default: transfer-gate gated_transfer)
-  --expiry <slot>            expirySlot (default 2000000000)
-  --prover <path>            prover binary (default crates/prover/target/release/blindseal-prover)
-  --audit-dir <dir>          audit base dir (default ~/.blindseal)
-  --help, -h                 this help
-
-Only clean verdicts are attested. The decision is appended to the hash-chained audit log first.
-`;
-var GATED_TRANSFER_DISC = "0x981894646560fc2b";
-function parse(argv) {
-  const o = { out: "attestation.json", instruction: GATED_TRANSFER_DISC, expiry: "2000000000", auditDir: path.join(os.homedir(), ".blindseal") };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === "--help" || a === "-h") o.help = true;
-    else if (a === "--out") o.out = argv[++i];
-    else if (a === "--target-program") o.targetProgram = argv[++i];
-    else if (a === "--instruction") o.instruction = argv[++i];
-    else if (a === "--expiry") o.expiry = argv[++i];
-    else if (a === "--prover") o.prover = argv[++i];
-    else if (a === "--audit-dir") o.auditDir = argv[++i];
-    else if (a.startsWith("--")) throw new Error(`unknown flag: ${a}`);
-    else o.file = a;
-  }
-  return o;
-}
-function findProver(explicit) {
-  if (explicit) return explicit;
-  let dir = process.cwd();
-  for (let i = 0; i < 7; i++) {
-    const c = path.join(dir, "crates/prover/target/release/blindseal-prover");
-    if (existsSync(c)) return c;
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error("prover binary not found; build crates/prover or pass --prover");
-}
-async function runAttestCli(argv) {
-  let o;
-  try {
-    o = parse(argv);
-  } catch (e) {
-    process.stderr.write(`blindseal attest: ${e.message}
-${HELP}`);
-    return 2;
-  }
-  if (o.help || !o.file) {
-    process.stdout.write(HELP);
-    return o.help ? 0 : 2;
-  }
-  if (!o.targetProgram) {
-    process.stderr.write("blindseal attest: --target-program is required\n");
-    return 2;
-  }
-  const raw = readFileSync(o.file, "utf8");
-  const call = JSON.parse(raw);
-  const payload = JSON.stringify({ tool: call.toolName, args: call.args });
-  const payloadHash = "0x" + createHash("sha256").update(payload).digest("hex");
-  const l0 = runLayer0(payload);
-  const result = l0.fired ? makeLayer0Result(l0) : runLayer1(payload);
-  const verdict = result.verdict;
-  const decisionId = "d_" + randomBytes(8).toString("hex");
-  const audit = openAudit(o.auditDir);
-  const entry = audit.chain.append({ decisionId, verdict, payloadHash });
-  process.stdout.write(`decision ${decisionId}: ${verdict} (audit #${entry.index} ${entry.hash.slice(0, 18)}\u2026)
-`);
-  if (verdict !== "clean") {
-    process.stderr.write(`blindseal attest: verdict is ${verdict} (${result.detectedPatterns.join(", ")}); no attestation for a non-clean call
-`);
-    return 1;
-  }
-  const action = parseSolanaAction(call.toolName, call.args);
-  if (!action) {
-    process.stderr.write("blindseal attest: the call is not a recognizable on-chain action\n");
-    return 1;
-  }
-  if (!action.recipient || !action.amount || !action.sourceAuthority) {
-    process.stderr.write("blindseal attest: action needs recipient, amount and source authority\n");
-    return 1;
-  }
-  const prover = findProver(o.prover);
-  const tmpPayload = path.join(os.tmpdir(), `blindseal-payload-${decisionId}.json`);
-  writeFileSync(tmpPayload, payload);
-  const args = [
-    "--payload",
-    tmpPayload,
-    "--out",
-    o.out,
-    "--decision-id",
-    decisionId,
-    "--chain-id",
-    String(action.chainId),
-    "--target-program",
-    o.targetProgram,
-    "--source-authority",
-    action.sourceAuthority,
-    "--recipient",
-    action.recipient,
-    "--mint",
-    action.mint,
-    "--amount",
-    action.amount,
-    "--instruction",
-    o.instruction,
-    "--expiry",
-    o.expiry
-  ];
-  process.stdout.write(`proving (this takes a while on CPU)\u2026
-`);
-  const r = spawnSync(prover, args, { stdio: "inherit" });
-  if (r.status !== 0) {
-    process.stderr.write(`blindseal attest: prover exited ${r.status}
-`);
-    return 1;
-  }
-  process.stdout.write(`attestation written: ${o.out} (decision ${decisionId}, payloadHash ${payloadHash})
-`);
-  return 0;
-}
-export {
-  runAttestCli
-};

package/dist/verify-HO4IU7XV.js

@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-import {
-  verifyOffchain
-} from "./chunk-BTIXDNTV.js";
-import {
-  isCleanWindow,
-  verifyDisclosure
-} from "./chunk-PQ457W6T.js";
-import "./chunk-PDX44BCA.js";
-
-// src/cli/verify.ts
-import { readFileSync } from "fs";
-var HELP = `blindseal verify \u2014 verify an attestation.json or a disclosure.json offline
-
-Usage:
-  blindseal verify <file>
-`;
-async function runVerifyCli(argv) {
-  const file = argv[0];
-  if (!file || file === "--help" || file === "-h") {
-    process.stdout.write(HELP);
-    return file ? 0 : 2;
-  }
-  const doc = JSON.parse(readFileSync(file, "utf8"));
-  if (Array.isArray(doc.entries) && typeof doc.signature === "string") {
-    const d = doc;
-    const v = verifyDisclosure(d);
-    process.stdout.write(`disclosure ${file}: ${v.ok ? "VALID" : `INVALID \u2014 ${v.reason}`}
-`);
-    if (v.ok) process.stdout.write(`  window #${d.from}\u2013#${d.to}, ${d.entries.length} entries, signer ${d.signerPubkey.slice(0, 16)}\u2026, clean window: ${isCleanWindow(d) ? "yes" : "no"}
-`);
-    return v.ok ? 0 : 1;
-  }
-  if (doc.proof && Array.isArray(doc.publicInputs)) {
-    const r = await verifyOffchain(doc);
-    process.stdout.write(`attestation ${file}: ${r.ok ? "VALID" : `INVALID \u2014 ${r.reason}`}
-`);
-    return r.ok ? 0 : 1;
-  }
-  process.stderr.write("blindseal verify: not an attestation.json or a disclosure.json\n");
-  return 2;
-}
-export {
-  runVerifyCli
-};