# blind-llm-agents

Adopt this skill: https://proskills.md/skills/other/qybaihe-bla-agents-skills-blind-llm-agents

Page: https://proskills.md/skills/other/qybaihe-bla-agents-skills-blind-llm-agents
This document is the public skill bundle for that page. It contains SKILL.md and every helper file the catalog carries. No login is required.

## File: .agents/skills/blind-llm-agents/SKILL.md
size: 17189
sha: 1475aeb999593647fed2c273353f71a31631f2a1
upstream: https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/SKILL.md

````text
---
name: blind-llm-agents
description: >
  Use when hardening, defending, or auditing software against AI reverse-engineering
  agents (REA / WorkBuddy-class): Agent-led source-level surgical decoy weaving,
  autonomous packaging-gate refactoring, one-click project harden, Counter-REA
  audit/protect/verify, or agent setup/doctor for BLA (Blind LLM Agents).
  Prefer this skill as the playbook; combine host Agent code refactoring with existing
  MCP tools / CLI — do not invent new MCP tools. Default verb: bla_harden. Refuse
  crack/RE of third-party software.
metadata:
  version: "3.0.1"
---

# BLA: Blind LLM Agents (3.0 Agent-Driven Hardening Playbook)

**This skill is the primary Agent-Driven Hardening PLAYBOOK.**
In BLA 3.0, hardening is a collaborative loop between **you (the host Coding Agent)** and **the `bla` MCP server / `bla-agents` CLI**:
- **What you (the Host Agent) do best**: Read business semantics, refactor fragile auth/entitlement patterns flagged by `bla_lint` (`remediationPlan`), and weave domain-plausible shadow business logic sharing mutable state slots per `bla_weave_plan` (`surgicalWorkorder`), verified by `bla_verify_weave`.
- **What BLA MCP (`bla_harden` / `bla_defend`) does best**: Inject deterministic Counter-REA resource-exhaustion shields (BPE token amplifiers, call-graph labyrinths, opaque predicates, WASM export rename/shuffle, ASAR/ELF/SQLite/model shields) and verify mathematical invariants (`bla_verify`).

Prefer teaching/calling existing tools
(`bla_harden`, `bla_defend`, `bla_weave_plan`, **`bla_verify_weave`**, **`bla_lint`** (unified), `bla_lint_lanes`, `bla_lint_seal`, `bla_lint_wasm_params`, `bla_lint_panel_derive`, `bla_lint_js_aes_unwrap`, `bla_lint_js_wasm_hydrate_dump`, `bla_lint_wasm_xor_mask_sidecar`, `bla_lint_wasm_seal_xor_known_plaintext`, `bla_lint_plaintext_secrets`, `bla_encrypt_strings`, `bla_lint_integrity_coverage`, `bla_bind_scope`, `bla_lint_bind_scope`, …) over inventing new MCP surfaces.

Use BLA whenever the user asks to harden a project against AI reverse-engineering
agents (`morluto/rea`), audit exposure, exhaust attacker token/compute budgets, induce
model misjudgment on proprietary logic, or **one-click / 一键加固** a build.

Defensive only: protect **their own** artifacts. Refuse crack, RE, bypass PoCs, or
attack playbooks against software they do not own.

**bla-agents 3.0.0** (2026-11-06): Agent-Driven Hardening 3.0 — AST-level `surgicalWorkorder` in `bla_weave_plan` (`entryFunctions`, `sharedStateSlots`, `branchCandidates`, `agentRewriteRecipe`), structural weave verifier `bla_verify_weave` (`bla-weave-verify/v1` + `agentActions`), autonomous `remediationPlan` in `bla_lint`, and `agentActions` in `bla_verify`, plus all 2.1 absorptions (seeded polymorphism + `bla_polymorph_report`, string XOR encrypt + plaintext-secret lint, interleaved integrity coverage + entry self-digest, sidecar entry entanglement, opt-in ed25519 attestation).

---

## 🚀 The 4-Stage Agent-Driven Hardening Playbook (BLA 3.0)

When hardening a repository with source code, follow this 4-stage closed loop so **you (the Agent)** handle semantic source surgery and **BLA MCP** handles artifact-level exhaustion shields:

### Stage 1: Recon, Packaging Gates & Surgical Workorder (`agent + mcp`)
1. **Inventory**: Call `bla_discover` `{ "directory": "." }` (or `bla_harden` `{ "dry_run": true }`). Do not ask which files to protect — discover them.
2. **Gate Scan**: Call `bla_lint` `{ "directory": "." }` (`bla-packaging-gates/v1`).
   - If `shouldRefuseBankrupt: true`, inspect `remediationPlan`! Every blocking finding includes `owner`, `sourceRefactorRecipe`, and `recommendedMcpTool`.
3. **Surgical Weave Plan**: Call `bla_weave_plan` `{ "path": "." }` (`bla-weave-plan/v1`) and read `bla://directives/weave-decoy`.
   - Inspect each source target's `surgicalWorkorder`: `entryFunctions`, `sharedStateSlots`, `branchCandidates`, `suggestedIdentifierStems`, and `agentRewriteRecipe`.

### Stage 2: Agent-Led Source Refactoring & Structural Decoy Weave (`agent-primary`)
1. **Remediate Packaging Footguns (do NOT just pass `allow_*` in production)**:
   - Follow `bla_lint`'s `remediationPlan` to refactor source code:
     - Rewrite per-byte/per-segment lane checks (`lane-independence`) into a whole-key chained ARX/FNV/SHA-256 accumulator or move unlock into WASM.
     - Mask cleartext sensitive literals (`plaintext-secret`) via `bla_encrypt_strings`.
     - Replace reversible `seal.json` commitments with one-way `SHA-256` (`certificateSha256`) and remove JS AES wrap-key / `memory.buffer` hydrate dumps.
   - Re-run `bla_lint` until `blocking` is empty (`shouldRefuseBankrupt: false`).
2. **Weave Domain-Plausible Shadow Business Logic**:
   - Using `surgicalWorkorder` from `bla_weave_plan`:
     - Reuse or introduce the recommended `sharedStateSlots` carrier so real business paths and shadow helpers read/write the **same** runtime state.
     - Author 2–3 non-trivial helper functions using **2/3 mundane stems** (`session`, `ledger`, `quota`, `epoch`) and **1/3 security stems** (`attest`, `commitment`, `seal`) — never `_bla_*` or empty `pass` stubs.
     - Wire call edges from `entryFunctions` into the shadow helpers guarded by state-dependent opaque-true invariants at `branchCandidates`.
   - For C/C++, Rust, or Go targets, call `bla_emit_headers` and include the emitted header in native sources.
3. **Verify Source Weave**:
   - Call **`bla_verify_weave`** `{ "path": "." }` (`bla-weave-verify/v1`).
   - If `overallPassed: false`, execute each item in `agentActions` (fixing any unreferenced helpers, missing shared-state mutations, or stem ratios) and re-run `bla_verify_weave` until `overallPassed: true`.

### Stage 3: Build & Post-Build Counter-REA Exhaustion Harden (`mcp-primary`)
1. If the project has a build step (`npm run build`, `cargo build`, etc.), run it so compiled artifacts reflect your Stage 2 source surgery.
2. Call **`bla_harden`** `{ "directory": ".", "weave_decoys": true, "self_seal": true, "sidecar_entangle": true }` (pass `wasm_preserve_exports` when a public WASM ABI must keep specific export names).

### Stage 4: Equivalence, Weave Acceptance & Bankruptcy Verification (`agent + mcp`)
1. Run the project's own test suite (`npm test` / `pytest` / CrackMe harness) to verify 100% functional equivalence.
2. Call `bla_verify` on hardened outputs (or inspect `bla_harden` verification results) and check `agentActions`:
   - Confirm `overallPassed: true`, `tokenAmplificationFactor >= 10`, and zero unresolved `agentActions`.

---

## ⚡ One-Sentence Fast Path (Artifact-Only / Pre-Built Tree)

When the user says **"Harden my software"**, **"一键加固"**, or points at an already-built directory without asking for source refactoring:

| Surface | Call |
| :--- | :--- |
| **MCP (preferred)** | `bla_harden` `{ "directory": "." }` |
| **CLI** | `npx bla-agents@latest harden .` |
| **MCP Prompt** | `bla-harden-project` |

Auto-discovers protectable build outputs, detects formats, runs **audit → defend
(bankrupt) → verify**. **Do not ask which files to protect — discover them.**

Optional args (safe defaults): `intensity` (bankrupt), `emit_manifest` (false),
`llm_directives` (false — risky bait), `weave_decoys` (false), `self_seal` (false),
`sidecar_entangle` (false), `wasm_preserve_exports`, `seed`, `output_directory`, `max_artifacts`, `dry_run`.

---

## Principles (red-blue R1–R12 → MCP/Skill 3.0)

### A. Bankrupt refuse gates (engine + MCP — call `bla_lint` first)

| Gate | Tool | Allow override (lab only) |
| :--- | :--- | :--- |
| Independent lane tables | `bla_lint_lanes` | `allow_lane_independent` |
| Plaintext / reversible seal JSON | `bla_lint_seal` | `allow_plaintext_seal` |
| Clear WASM `R2SEAL`/`R3PARM`/`R3CIPH` | `bla_lint_wasm_params` | `allow_wasm_clear_params` |
| JS AES wrap-key + create*iv + fixed hdr | `bla_lint_js_aes_unwrap` | `allow_js_aes_unwrap` |
| Panel `deriveLocal` + `panelTokenSha256` oracle | `bla_lint_panel_derive` | `allow_panel_offline_oracle` |
| JS←WASM hydrate salt/rounds/cipher dump | `bla_lint_js_wasm_hydrate_dump` | `allow_js_wasm_hydrate_dump` |
| WASM XOR-mask beside masked pack | `bla_lint_wasm_xor_mask_sidecar` | `allow_wasm_xor_mask_sidecar` |
| `seal.revision` as XOR known-plaintext | `bla_lint_wasm_seal_xor_known_plaintext` | `allow_wasm_seal_xor_known_plaintext` |
| Cleartext sensitive literals (panel/license) | `bla_lint_plaintext_secrets` / `bla_encrypt_strings` | `allow_plaintext_string` |

Prefer **one** project scan: MCP `bla_lint` / CLI `bla lint .` (schema `bla-packaging-gates/v1` with `remediationPlan`). Individual `bla_lint_*` remain for single-file drills. Bankrupt harden **refuses** the six carrier/JS/WASM gates unless the matching allow flag is set; lanes/panel also refuse at protect-time.

Also: do **not** ship a stable public WASM ABI without explicit `wasm_preserve_exports`; maximum/bankrupt **rewrites** `__vaultPanelDerive_*` / `deriveLocal` unless `allow_stable_panel_derive`. Multi-artifact trees: bankrupt sets `selfSealRecommended` — prefer **`self_seal`** and **`sidecar_entangle`** (sibling SHA-256 **hard-fail**; opaque-seed alone does not gate entitlement).

### B. Product recipe principles (Skill layer — not new refuse lints)

- Sensitive literals in panel.html / license.cjs must not remain cleartext in shipped artifacts; prefer `bla_encrypt_strings` (seed-derived XOR — never JS AES wrap-key). Lint with `bla_lint_plaintext_secrets`.
- Integrity checkers must be interleaved and mutually covering (coverage matrix `bla-integrity-coverage/v1`); single-point self-seal is refuse-worthy. Lint with `bla_lint_integrity_coverage`.
- Optional bind-scope (domain/date) is a **public** license contract (`bla_bind_scope` → `bind-scope.json` + `BLA_BIND_SCOPE_CHECK`). Default OFF. Never a covert backdoor — `public:true` mandatory; lint with `bla_lint_bind_scope`.
- Coverage claims must be real, not paper: an entry may only count as covering itself when its runtime check hard-fails on its own bytes (canonical self-digest, finalized at write). Check `integrityCoverageSelfVerified` on the harden report; when false the matrix drops self edges and refuses. Keep host-trust values (e.g. certificate digests) inside a covered artifact — unhardened data sidecars like `seal.json` are not covered.

Held across R8–R12 (NO PRIZE). Keep in gate design; do **not** invent packaging refuse lints for these:

- Unlock **inside WASM** (`unlock(keyPtr,keyLen)->outLen`); JS only writes key / reads result UTF-8.
- Mask via **one-way** KDF (`SHA-256(key[16])`), never algebraically invertible byte mix.
- Keep public digests (**`seal.revision`**) **out** of XOR-masked plaintext; commitment in a separate clear segment.
- Randomize pack header `pad3` + seed-derived rounds (close structural KP).
- Keep the **crypto schedule / harden seed private** (derive from release secrets); a public `seed` in SEAL re-opens header KP and strips the mask without WASM RE. Publish only `flagSha256`/`certificateSha256` for prove-solve — **never** `keySha256` (offline key oracle). `bla_lint` warns (`public-materialization-seed`, `public-key-digest-oracle`); warning only, not a refuse gate.
- Host resolves unlock by **arity + `FLAG{…}` shape + `sha256===certificateSha256`**, never export name/order.
- JS honeypot/canary ≠ WASM unlock (decoy must fail certificate check).

### C. Engine defaults already on (hygiene, not refuse)

At maximum/bankrupt WASM protect: export rename, **arity-2-preferring decoy alias spread**, **independent export-order shuffle**, honesty fields `wasmExportRenameApplied` / `wasmExportOrderShuffled` / `wasmExportDecoysInjected`. Cleartext may also scatter unlock body index (recipe).

### D. Honesty residual (do not water refuse lints)

Gates close **packaging** footguns. They do **not** claim white-box secrecy against full WASM RE + online/SMT vs SHA-256 commitment (R8–R12 P2). Body-size fingerprinting among arity-2 exports is P3 / diminishing returns — not a new refuse gate. `defenseScore` is an honest soft-cap, not preimage hardness.

## Prerequisites (once)

1. CLI: `npx bla-agents@latest setup`
2. Then: `npx bla-agents@latest doctor` (or MCP `bla_doctor`) — checks the installed
   skill bundle (this file + `references/`, including format appendices) is complete

## Write safety (principles)

- Unsure what will be touched? `bla_discover` or `bla_harden` `{ "dry_run": true }` —
  both write nothing. If `truncated: true`, page with `offset` from `nextOffset` until
  the tail is retrieved (do not silently drop artifacts past the 64 default cap), or
  raise `max_artifacts` / narrow the directory.
- Never overwrite without the user's go-ahead. On `confirmation_required`, show
  `wouldOverwrite`, ask, then retry with `confirm_overwrite: true` (or a new path).
- Long `bla_harden` runs may emit MCP `notifications/progress` when the client
  sets `_meta.progressToken`. Cancel with `notifications/cancelled`
  `{ requestId }` — already-written paths are listed on the cancelled report
  (`cancelled: true`, `written: [...]`); there is no silent half-harden.
  Same rule for `in_place: true` (overwrites the input).
- Report writes from the tool receipt (`writeReceipt` / `wouldOverwrite`), not guesses.
- After a successful harden/defend/protect, keep the returned unsigned `runId` (and
  harden `summaryPath`). Re-check later with `bla_run_lookup` or `bla_verify` +
  `summary_path`/`run_id` — never invent a run id.
- `bla_rea_drift` / `bla_redteam_report` may return `status: unverified` when sibling
  REA is absent; treat that as **not proven**, never as a pass. An on-disk
  `bla_redteam_report` without `execute:true` is `status: available` — readable
  evidence, not a fresh REA verdict.
- `bla_harden` `{ "dry_run": true }` always has `overallSuccess: false`; only real
  writes return `writeReceipt`.

## Decision tree (short)

| Intent | Prefer |
| :--- | :--- |
| Project / build dir | **`bla_harden`** |
| Named artifact | **`bla_defend`** (or granular `bla_audit` → `bla_protect` → `bla_verify`) |
| Inventory only (page 64+ with `offset`/`nextOffset`) | **`bla_discover`** |
| Surgical source weave & verification | Resource `bla://directives/weave-decoy` → **`bla_weave_plan`** (`surgicalWorkorder`) → Agent edits source → **`bla_verify_weave`** → `bla_harden` (`weave_decoys: true`) |
| Packaging footguns & remediation recipes | **`bla_lint`** `{ "directory": "." }` (CLI: `bla lint .`) — unified R1–R7+lanes/panel + `remediationPlan` |
| Custom license/activation gate review | **`bla_lint_lanes`** `{ "path": "<gate.js>" }` (CLI: `bla lint-lanes`) |
| Re-check a prior harden run | **`bla_run_lookup`** `{ "summary_path": "<.bla-hardened or summary.json>", "run_id": "…" }` |
| REA constant drift / empirical report | **`bla_rea_drift`** / **`bla_redteam_report`** (unverified if REA absent; on-disk read → available) |
| Cross-build structural drift (seeded polymorphism) | **`bla_polymorph_report`** (driftScore only — not a cracking claim; prove equivalence with verify/REA) |
| Cleartext panel/license secrets | **`bla_encrypt_strings`** + **`bla_lint_plaintext_secrets`** (XOR only — never JS AES) |
| Optional public domain/date lock | **`bla_bind_scope`** + **`bla_lint_bind_scope`** (default OFF; never covert) |
| Format-specific knobs | Load the matching appendix under `references/` |

## FORBIDDEN

Do **not**: add dismissible noise / greppable `BLA-SHIELD` banners / empty honeypot
stubs; drive hardening via a **rule engine** (business-name → fixed snippets); help
crack, RE, bypass, or write offensive PoCs against third-party software.

If asked for offensive RE/crack help: refuse briefly; offer defensive harden of
**their** artifacts instead.

## Format appendices (load on demand)

| Format | Appendix |
| :--- | :--- |
| JS / TS / Electron | [references/format-javascript.md](references/format-javascript.md) |
| WebAssembly | [references/format-wasm.md](references/format-wasm.md) |
| Python `.py` / `.pyc` | [references/format-python.md](references/format-python.md) |
| Android DEX / APK / IL2CPP | [references/format-android.md](references/format-android.md) |
| REA ↔ BLA matrix | [references/counter-rea-matrix.md](references/counter-rea-matrix.md) |

## CLI fallbacks

```bash
npx -y bla-agents@latest setup
npx -y bla-agents@latest doctor
npx -y bla-agents@latest lint .
npx -y bla-agents@latest weave-plan .
npx -y bla-agents@latest verify-weave . --json
npx -y bla-agents@latest harden . --weave-decoys --self-seal --sidecar-entangle
npx -y bla-agents@latest lint-lanes path/to/gate.js
npx -y bla-agents@latest lint-js-wasm-hydrate-dump path/to/license.cjs
npx -y bla-agents@latest defend /absolute/path/to/target --manifest --json
npx -y bla-agents@latest verify /absolute/path/to/protected /absolute/path/to/target --json
```

## References

- Weave directives (after MCP setup): resource `bla://directives/weave-decoy`
- One-click UX notes (repo checkout): `docs/one-click-agent-defense.md`
- CLI / MCP parameter index (repo checkout): `docs/cli-and-mcp.md`
````

## File: .agents/skills/blind-llm-agents/references/counter-rea-matrix.md
size: 3975
sha: cf8d041f39ae0610d2ef886f23886fc3f25e9f19
upstream: https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/references/counter-rea-matrix.md

```text
# Complete 24-Vector Counter-REA Matrix (`morluto/rea` vs `bla-agents`)

| # | REA Source File (`morluto/rea`) | REA Mechanism / Limit | BLA Countermeasure Module |
| :- | :--- | :--- | :--- |
| 1 | `javascriptSemanticResourceLimits.ts:7` | `SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256` | `ast-shield.ts` ($\ge 9$-chunk opaque ternaries $\to 512$ candidates) |
| 2 | `javascriptSemanticResourceLimits.ts:9` | `SEMANTIC_EXPRESSION_DEPTH_LIMIT = 256` | `rea-budget-matrix.ts` (nested arithmetic identity chains) |
| 3 | `javascriptSemanticResourceLimits.ts:11` | `SEMANTIC_GETTER_EXPANSION_LIMIT = 512` | `tarpit-generator.ts` (self-referential getter rings) |
| 4 | `javascriptSemanticResourceLimits.ts:13` | `SEMANTIC_ALIAS_SELECTION_LIMIT = 512` | `tarpit-generator.ts` (528+ dynamic selector states) |
| 5 | `javascriptSemanticResourceLimits.ts:15` | `SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1 MiB` | `tarpit-generator.ts` (`codeUnits * 6 + 2` Cartesian string explosion) |
| 6 | `ReconstructionObligationPolicies.ts:15` | 22 Application & Semantic Obligation Families | `obligation-flooder.ts` (floods all 22 families $\to 68+$ mandatory cases) |
| 7 | `promptContracts.ts:52` | `COMMON_DISCIPLINE` (`Observations` vs `Unknowns`) | `shadow-business-logic.ts` + `evidence-contract-poison.ts` |
| 8 | `promptContracts.ts:139` | `procedure_callers` / `procedure_callees` / `xrefs` | `callgraph-labyrinth.ts` (Tarjan SCC mutually-recursive clusters) |
| 9 | `ReconstructionObligationLedgerProjection.ts:24` | `compareUnicodeCodePoints` lexicographical sort | `prompt-completion-poison.ts` (`$00_AAA_enclave_` priority prefix) |
| 10 | `promptContracts.ts:157` | `compare_application_versions` / `compare_functions` | `diff-noise-injector.ts` (seed-keyed isomorphic switch permutations) |
| 11 | `promptContracts.ts:262` | `trace_crash` (`search_strings` $\to$ `build_call_path`) | `crash-trace-decoy.ts` (`SIGSEGV_ENCLAVE_EPC_PAGE_FAULT` lures) |
| 12 | `electronStaticAnalysisIpc.ts` | Unique literal IPC channel pairing rule | `ast-shield.ts` (de-literalizes real IPC + registers duplicate decoy channels) |
| 13 | `ElectronFuseReader.ts:36` | `maximumSentinelsPerSlice = 32` | `electron-fuses.ts` (hardens V1 fuses + appends 33 decoy sentinels) |
| 14 | `CdpCaptureEvents.ts` | JSON body & WebSocket shape budget (`depth >= 760`) | `cdp-shape-budget-breaker.ts` (780+ nested JSON envelopes) |
| 15 | `fridaCaptureLimits.ts:8` | `MAX_JSON_DEPTH = 64`, `MAX_MESSAGE_TEXT_BYTES = 32 KiB` | `frida-capture-saturation.ts` (68+ level JSON + 34 KiB message text) |
| 16 | `SqliteDatabaseInspection.ts:792` | Bare `readOnly: true, allowExtension: false` snapshot | `sqlite.ts` (`GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL`) |
| 17 | `SafetensorsHeader.ts:74` | `MODEL_JSON_NESTING = 32` | `model.ts` (35-level nested JSON array under `_bla_nesting_breaker`) |
| 18 | `GgufHeader.ts:121` | `MODEL_METADATA_NESTING = 32` | `model.ts` (35-frame nested GGUF `ARRAY` preserving existing KV/tensors) |
| 19 | `wasmInterface.ts:90` | `WASM_INTERFACE_REPRESENTATION_BYTES = 32 MiB` | `wasm-interface-exhaustion.ts` + `wasm.ts` (`6x` string + `16x` signature charge) |
| 20 | `RustBinaryProvider.ts` | `MAX_RUSTC_HASHES = 64` & `.dep-v0` crate recovery | `native.ts` (72 decoy rustc hashes + decoy `.dep-v0` / Go buildinfo) |
| 21 | `DartAotSnapshot.ts` | `SUPPORTED_SNAPSHOT_PROFILES` & `_kDartVmSnapshot*` | `native.ts` (spoofed Dart AOT snapshot symbols & version strings) |
| 22 | `PropertyListDecodeBudget.ts:80` | XML plist `token.doctype && token.internalSubset` | `apple-plist.ts` (`<!DOCTYPE plist ... []>` empty internal subset abort) |
| 23 | `ManagedDecodeBudget.ts:9` | `.NET` `reserveRow = 256` & `reserveString = 6x + 2` | `dotnet-managed.ts` (managed heap string & P/Invoke obligation flood) |
| 24 | `AndroidDex.ts` & `Il2CppMetadata.ts` | DEX string/type table & Unity `0xFAB11BAF` metadata | `mobile-game.ts` (recomputed SHA-1/Adler32 DEX + IL2CPP enclave types) |
```

## File: .agents/skills/blind-llm-agents/references/format-android.md
size: 1091
sha: 4f2b221caaecefea0a6461310eab52efcf0b935b
upstream: https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/references/format-android.md

```text
# Format appendix: Android DEX / APK / IL2CPP

Load this when hardening Android packages, DEX, or Unity IL2CPP metadata.

## What BLA touches

- **DEX**: string/type-table densification with recomputed SHA-1 / Adler32 (see Counter-REA matrix ↔ `mobile-game.ts`).
- **APK / ZIP**: member-level hardening for unprotected members; **signed APKs fail closed** — resign after shield, or shield unsigned inputs.
- **IL2CPP**: enclave-type / metadata decoys around Unity `0xFAB11BAF` surfaces.

## Agent workflow

1. Prefer `bla_discover` / `bla_harden` `{ "dry_run": true }` on the build output dir to see which `.dex` / `.apk` / native members are in scope (`truncated` matters on large trees).
2. Harden with `bla_harden` (directory) or `bla_defend` (named artifact). Use `confirm_overwrite` when re-running into an existing output.
3. Do not treat a high `defenseScore` as proof against offline crypto attacks — score scope is Counter-REA gates + exposure drop.

## Related matrix rows

See [counter-rea-matrix.md](./counter-rea-matrix.md) rows for `AndroidDex.ts` / `Il2CppMetadata.ts`.
```

## File: .agents/skills/blind-llm-agents/references/format-javascript.md
size: 5011
sha: c3a8d98a46df69d82218eb2e7f547ceacfbc2cd6
upstream: https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/references/format-javascript.md

```text
# Format appendix: JavaScript / TypeScript / Electron

Load this when hardening JS/TS bundles, Node modules, HTML bundles, or Electron `.asar`.

## Defaults

- JS AST weave is **always on** during protect/defend/harden (not gated by `weave_decoys`).
- Prefer `bla_harden` for a project/build dir; `bla_defend` / `bla_protect` for a named file.
- Honey source maps default **on**. MCP: `honey_source_maps` (protect). CLI: `--no-honey-maps` to disable.

## Stronger options (opt-in)

| Goal | MCP | CLI / config |
| :--- | :--- | :--- |
| Sibling-module integrity binding | `self_seal: true` | `--self-seal` / `.blarc` `"selfSeal": true` |
| Structural decoys (also helps Python in the same tree) | `weave_decoys: true` | `--weave-decoys` |
| Overwrite the input file | `in_place: true` **and** `confirm_overwrite: true` | `--in-place` |

Self-seal soft-skips in pure browser builds (digest stays 0). Pair with weave when the tree also has Python customer defs.

## Verify honesty

`defenseScore` soft-caps JS-like targets with `self-seal-not-enabled` unless verify knows seal ran. After `bla_protect` / `bla_defend`, pass `self_seal_enabled: true` into `bla_verify` when the protect report shows `selfSeal: true` (defend/harden already forward this internally).

## Electron notes

IPC ambiguity + route mirage layers activate on JS/TS/asar/directory targets during verify. Prefer defending the packaged `.asar` or the `dist/` that ships to users, not only sources.

## Lane-independence (gates / entitlement)

Do **not** keep independent per-byte / per-lane JS check tables (`Object.freeze(parseInt hex…)`, `charCodeAt(i)` → wasm mix/seal per lane). Prefer **whole-key chained mixing**. `bla_lint_lanes` returns severity **error**; harden/defend/protect **refuse** unless `allow_lane_independent` / `--allow-lane-independent` (teaching fixtures only).

## Plaintext seal sidecars (red-blue round-2)

`bla harden` protects discovered JS/WASM/HTML artifacts — **not** adjacent `seal.json` / catalog files you copy next to the output. If a gate loads salts, expected digests, or certificate ciphertext from sibling JSON (or a WASM data-section twin), that material stays attacker-readable.

Rules of thumb:

1. Prefer **one-way** commitments (`SHA-256` / HMAC) for public `revision` / compare digests. Custom reversible ARX/Feistel “digests” invert to the key when salt+rounds are public.
2. Encrypt or omit seal sidecars in the shipped tree; or fold them under **`self_seal`** / a sealed blob bound to the entry module.
3. Dual-publish (JSON + WASM `R2SEAL` data) without encryption doubles the same exposure.

**Engine gate:** `bla_lint_seal` / CLI `bla lint-seal` flags reversible plaintext seals. At **bankrupt**, harden/protect **refuse** unless `allow_plaintext_seal` / `--allow-plaintext-seal` / `.blarc` `"allowPlaintextSeal": true` (lab fixtures only). One-way SHA-256 seals without invertible ARX params pass.

## One-way seals still need packaging (red-blue round-3)

Round-3 confirmed: SHA-256 (or HMAC) public `revision` **stops** seal-only ARX inversion. That is necessary, not sufficient:

1. Digests-only `seal.json` still triggers `plaintext-seal-sidecar` **warning** (`shouldRefuseBankrupt: false`). Prefer omit/encrypt/`self_seal`.
2. Do **not** dual-carry runtime salt/rounds/ciphertext as clear WASM data next to the seal (`R3PARM`/`R3CIPH`-class ASCII magics). Encrypt, relocate, or bind under self-seal.
3. Strip or rename stable panel helpers such as `__vaultPanelDerive_*`, and avoid leaving classic FNV primes as readable literals in HTML bundles when they back entitlement tokens.
4. For multi-artifact gates (JS + WASM + HTML + seal), turn on **`self_seal`** so siblings cannot be freely swapped/instrumented.

## Round-3 residual gates

- `bla_lint_panel_derive` / `bla lint-panel-derive` flags stable `__vaultPanelDerive_*`; maximum/bankrupt protect rewrites to `_blaPd_*` unless `allow_stable_panel_derive`.
- Multi-artifact trees: bankrupt harden reports `selfSealRecommended` — pass `self_seal: true` (auto sibling bind on harden). Single-file stays opt-in only.

## Round-4 residual gates (AES wrap + panel oracle)

AES-CTR sealed WASM param blobs without clear `PARM` magic still leak when **JS** holds a recoverable wrap key and calls `createDecipheriv` / `createCipheriv` against a fixed hdr beacon (e.g. `d17ea004`). This is **not** white-box AES.

| Gate | Surface | Default |
| :--- | :--- | :--- |
| `bla_lint_js_aes_unwrap` / `bla lint-js-aes-unwrap` | wrap-key + create*iv + fixed hdr | bankrupt **refuse** unless `allow_js_aes_unwrap` / `--allow-js-aes-unwrap` |
| `bla_lint_panel_derive` | `deriveLocal` rewrite + `panelTokenSha256` oracle | rewrite `_blaPdLocal_*`; bankrupt **refuse** oracle combo unless `allow_panel_offline_oracle` |

Prefer unwrap inside WASM; scrub plaintext panel token digests; do not ship a callable derive UI beside seal digests. Self-seal sibling SHA-256 hard-fail is separate and already on when siblings exist at protect time.
```

## File: .agents/skills/blind-llm-agents/references/format-python.md
size: 984
sha: 07843084b6475faf250ae80dab393c39bf46fbe4
upstream: https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/references/format-python.md

```text
# Format appendix: Python (`.py` / `.pyc`)

Load this when hardening Python sources or bytecode.

## `weave_decoys` is the structural switch

| Flag | `.py` behavior | `.pyc` behavior |
| :--- | :--- | :--- |
| `weave_decoys: false` (default) | Warm-init / tarpit only — not structural customer-def weave | Trailer-oriented |
| `weave_decoys: true` | Customer `FunctionDef` bodies get shared-slot touch + opaque-false decoy calls | Customer `co_consts` CODE weave |

JS AST weave in the same tree stays always-on regardless of this flag.

## Recommended path

1. Read MCP resource `bla://directives/weave-decoy` (directives travel with the MCP server; no repo checkout required).
2. Plan: `bla_weave_plan` `{ "path": "<project-or-file>" }`.
3. Apply: `bla_harden` / `bla_defend` / `bla_protect` with `weave_decoys: true`.

## PyInstaller honesty

CArchive peel on onefile bundles is expected. Densify by shielding `.py`/`.pyc` **before** bundling rather than only the final binary.
```

## File: .agents/skills/blind-llm-agents/references/format-wasm.md
size: 3215
sha: 09af62af1b9f112b3d695325da2d99054c79888f
upstream: https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/references/format-wasm.md

```text
# Format appendix: WebAssembly

Load this when hardening `.wasm` modules.

## Intensity & rename

At `maximum` / `bankrupt`, BLA renames **all** exports not listed in the preserve list (red-blue round-1: silent `mix`/`seal` ABI enabled preload hooks). Do **not** ship a stable public WASM ABI unless glue truly requires it — and then list names **explicitly**:

| Surface | How |
| :--- | :--- |
| MCP | `wasm_preserve_exports: ["main","add"]` on harden/defend/protect |
| CLI | `--wasm-preserve-exports main,add` |
| Config | `.blarc` `"wasmPreserveExports": ["main","add"]` |

Glue that imports renamed symbols should consume the rename map from the protect report.

## Verify honesty

Standalone `bla_verify` soft-caps WASM with `wasm-export-rename-pending` unless you pass `wasm_export_rename_applied: true` (set when `ProtectionResult.wasmExportRenameApplied` was true). Defend/harden already forward that flag into their embedded verify step.

## Data-section seal carriers (red-blue round-3)

Export rename closes the public `mix`/`seal` hook surface. It does **not** hide plaintext entitlement material in active data:

- Avoid shipping ASCII magics such as `R2SEAL` / `R3PARM` / `R3CIPH` followed by clear salt, round counts, invertible revisions, or certificate ciphertext.
- If the gate must load schedule params from WASM, encrypt them or bind the blob under **`self_seal`** with the entry module — especially when a sibling `seal.json` already publishes one-way digests.

## Round-3 residual gate

- Run `bla_lint_wasm_params` / `bla lint-wasm-params` before shipping. Bankrupt harden refuses clear param/cipher magics unless `allow_wasm_clear_params`.
- This is a **detection gate**, not data-section encryption.

## Sealed blobs still need JS honesty (red-blue round-4)

Encrypting WASM data (no clear `R3PARM`) closes the ASCII-carrier lint. If the **JS loader** still does `Buffer.from(WRAP_KEY_HEX, "hex")` + `createDecipheriv` against a fixed hdr, Node instrumentation recovers params. Run `bla_lint_js_aes_unwrap` on the loader; bankrupt refuses that footgun. BLA does **not** claim white-box AES.

## Unlock-in-WASM + mask hygiene (red-blue R5–R12)

Export rename closes public `mix`/`seal` hooks. It does **not** replace careful entitlement packaging:

| Round | Do | Lint / engine |
| :--- | :--- | :--- |
| R5–R6 | Keep ARX+compare+decrypt **inside** `unlock`; JS must not hydrate→dump salt/rounds/cipher | `bla_lint_js_wasm_hydrate_dump` |
| R6 | Never store plaintext XOR mask beside masked pack | `bla_lint_wasm_xor_mask_sidecar` |
| R7 | Never put `seal.revision` under repeating XOR mask; use one-way mask KDF | `bla_lint_wasm_seal_xor_known_plaintext` |
| R8+ | `SHA-256(key)` mask; commitment **outside** XOR; entropy pad ≠ revision | Skill recipe (R7 lint covers KP) |
| R9 | Seed-derived rounds + nonzero pad3 | Skill recipe |
| R10–R12 | Engine: arity-2 alias spread + export-order shuffle + prefer arity-2 decoys | protect defaults |
| Host | Resolve by arity + FLAG shape + `certificateSha256`, never first export | Skill recipe |

Project scan: `bla_lint` / `bla lint .`. Honesty: full WASM RE + online/SMT vs commitment remains possible — gates ≠ white-box.
```

## File: README.md
upstream: https://github.com/qybaihe/bla/blob/main/README.md

````text
<div align="center">

**English** · [简体中文](docs/readme/README_zh.md) · [繁體中文](docs/readme/README_zh-TW.md) · [日本語](docs/readme/README_ja.md) · [한국어](docs/readme/README_ko.md) · [Türkçe](docs/readme/README_tr.md) · [Русский](docs/readme/README_ru.md) · [Tiếng Việt](docs/readme/README_vi.md) · [ไทย](docs/readme/README_th.md) · [Deutsch](docs/readme/README_de.md) · [Español](docs/readme/README_es.md) · [Français](docs/readme/README_fr.md) · [Українська](docs/readme/README_uk.md) · [Polski](docs/readme/README_pl.md) · [Português (Brasil)](docs/readme/README_pt-BR.md) · [العربية](docs/readme/README_ar.md) · [فارسی](docs/readme/README_fa.md) · [Bahasa Indonesia](docs/readme/README_id.md) · [Italiano](docs/readme/README_it.md) · [Ελληνικά](docs/readme/README_el.md) · [മലയാളം](docs/readme/README_ml.md) · [Roman Urdu](docs/readme/README_ur-Latn.md) · [Română](docs/readme/README_ro.md)

# <img src="docs/assets/logo.png" alt="BLA Shield" width="42" align="absmiddle" /> BLA: Blind LLM Agents

### Make reverse engineering bankrupt again.

**Point BLA at the build you ship. When an AI reverse-engineering agent (REA) opens it, the analyzer hits resource budgets, follows decoys, and burns tokens — while your users still get the same runtime behavior.**

[![npm version](https://img.shields.io/badge/npm-bla--agents-2563eb?style=flat-square&logo=npm)](https://www.npmjs.com/package/bla-agents)
[![GitHub Trending](https://img.shields.io/badge/GitHub_Trending-%2315_Daily-7c3aed?style=flat-square&logo=github&logoColor=white)](https://trendshift.io/repositories/323569)
[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-3b82f6?style=flat-square)](docs/cli-and-mcp.md)
[![Node.js](https://img.shields.io/badge/Node.js-%5E22.23.4_%7C%7C_24.x-0284c7?style=flat-square&logo=nodedotjs&logoColor=white)](#format-coverage)
[![Counter-REA](https://img.shields.io/badge/Counter--REA-empirically_measured-1d4ed8?style=flat-square)](#empirical-results-vs-real-rea)
[![MIT license](https://img.shields.io/badge/license-MIT-38bdf8?style=flat-square)](LICENSE)

**[Website](https://bla.tools/) · [Guides](https://bla.tools/guides/) · [Showcases](https://bla.tools/showcase/) · [Disclaimer](DISCLAIMER.md)**

[Quick start](#quick-start) · [Empirical results](#empirical-results-vs-real-rea) · [Format coverage](#format-coverage) · [Benchmark](#benchmark-14-targets-internal-estimates) · [FAQ](#faq)

```bash
bla harden .
# or tell your agent: "Harden my software against REA"
```

</div>

<p align="center">
  <a href="https://trendshift.io/repositories/323569" target="_blank" rel="noopener noreferrer">
    <img src="docs/assets/bla-github-trending-badge.png" alt="GitHub Trending — #15 Repository Of The Day" width="280" height="56"/>
  </a>
</p>

> [!IMPORTANT]
> BLA is a **defensive** tool for protecting **your own** software. See [DISCLAIMER.md](DISCLAIMER.md).
> Get BLA from [qybaihe/bla](https://github.com/qybaihe/bla) or [npm `bla-agents`](https://www.npmjs.com/package/bla-agents).

<div align="center">
<img src="docs/assets/bla-vs-rea-showcase.svg" alt="Side-by-side: REA on an unprotected artifact vs BLA-protected output" width="1200" />
</div>

---

## What BLA does

REA reverse-engineers release artifacts in one command. BLA is the Counter-REA half of that story:

| Layer | What happens |
| --- | --- |
| **Poison** | Plant format-valid canaries, honey metadata, and decoy control flow that look like real evidence. |
| **Exhaust** | Push the artifact past REA's documented resource budgets (headers, nesting, interface inventories, PCAP JSON, fuse sentinels, …). |
| **Hallucinate** | Leave the analyzer with truncated inventories, redaction failures, and ambiguous rabbit holes — while **runtime stays equivalent**. |

One sentence covers the common case (auto-discovers `dist/` / `build/` / `.asar` / `.wasm` / `.sqlite` / models / … and runs audit → protect → verify):

```bash
npx bla-agents harden .
# MCP / agent: bla_harden   ·   "Harden my software against REA"
```

Same pipeline as `bla defend` / `bla_defend` when you already know the path; `harden` is the default one-command UX.

## Quick start

```bash
# Node.js ^22.23.4 or 24.x recommended (REA red-team needs zlib.zstd on 22.23+)
npx bla-agents setup          # register MCP + skill with your coding agent
npx bla-agents harden .       # one-command Counter-REA pass on the current project
npx bla-agents benchmark      # 14-target showcase (local estimates + runtime checks)
```

Ask your agent after setup (skill guides one-click harden):

```text
Harden my software against REA
```

Or run stages explicitly: `audit` · `protect` · `verify` · `defend` — see [one-click agent defense](docs/one-click-agent-defense.md) and [CLI and MCP](docs/cli-and-mcp.md).

---

## Empirical results vs real REA

These numbers come from running **real REA** against BLA-hardened samples on commodity hardware (`npm run redteam:rea`). Full machine-readable report: [`docs/redteam/empirical-rea-validation.md`](docs/redteam/empirical-rea-validation.md) / [`.json`](docs/redteam/empirical-rea-validation.json).

**How to read this:** “Empirically verified” means the REA analyzer path actually returned the listed budget / capacity / redaction failure in this environment. It is **not** a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here.

### Empirically verified on commodity hardware

Recorded under **Node v24.22.1** with optional **Wabt 1.0.42** + **tshark 4.4** when noted. Soft-skips keep Node 22 / CI green when tooling is absent.

| Format | Before → after | REA outcome after BLA | Budget / error |
| --- | ---: | --- | --- |
| **Go buildinfo** | 50 KiB → 1.16 MiB | capacity error | `MAX_BUILD_INFO_BYTES` (1 MiB) — *Go build-info string length exceeds the 1 MiB limit* |
| **Erlang BEAM** | 84 B → 262 KiB | capacity error | `max_chunks` — *BEAM form exceeds the 64-chunk budget* |
| **EVM bytecode** | 16 B → **4.00 MiB** | approaches full input cap | `EVM_INTERFACE_LIMITS.inputBytes` (4 MiB) |
| **PCAP** | 24 B → 1.29 MiB | budget rejected | `TSHARK_JSON_MAX_BYTES` (>8 MiB) → `AnalysisResourceConstraintError` (tshark present) |
| **Electron ASAR** | 607 B → **16.9 MiB** | capacity error | `DEFAULT_ASAR_MAX_HEADER_BYTES` (16 MiB) |
| **WASM + Wabt** | 54 B → **6.56 MiB** · 251 exports | `ifaceState=partial` | `WASM_INTERFACE_REPRESENTATION_BYTES` — *Typed WASM interface decoding exceeds the WABT output representation budget* |
| **SQLite** (Node 24) | 12 KiB → 56 KiB | redaction / column eval | `SqliteColumnEvaluationFailure` — unknown `enclave_unseal_payload()` on honey trap columns |
| **JavaScript** | 761 B → 116 KiB | budget rejected | `alias-selections` + `getter-expansion` + `primitive-bytes` + `primitive-candidates` (real REA `resourceLimits`) |
| **Safetensors** | 128 B → 10.1 KiB | capacity error | `MODEL_JSON_NESTING` — *Safetensors JSON nesting exceeds 32 levels* (HF-loadable; tensor bytes unchanged) |
| **GGUF** | 24 B → 7.7 KiB | capacity error | `MODEL_METADATA_NESTING` — *GGUF metadata nesting exceeds 32 array frames* |
| **Electron fuses** | 50 KiB → 1.16 MiB | budget rejected | `ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice` (>32) |
| **Flutter pool** | 50 KiB → 1.16 MiB | projected cap | `MAX_POOL_URIS` / `MAX_POOL_TOKENS` (REA would truncate with “at least N”) |

Reproduce:

```bash
# Prefer Node 22.23.4+ or 24.x; set Wabt/tshark for full coverage
export REA_WABT_BIN_DIRECTORY=$HOME/opt/wabt-1.0.42/bin   # optional
npm run build && npm run redteam:rea
```

### Designed-for but **not** empirically verified here

These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path needs **native tooling we did not run** on this box:

| Area | Why unverified here |
| --- | --- |
| Ghidra / native decompilation depth | Requires a Ghidra install + REA bridge |
| Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach |
| JADX / full Android APK pipeline | APK 
````