v1.2.0 to v2.0.0

136 added, 31 removed. Audit A to A.

---

name: blind-llm-agents

- description: Audit, protect, and verify software artifacts (JavaScript/TypeScript, Electron ASAR, WebAssembly, Python .py/.pyc, SQLite, Safetensors/GGUF AI Models, Android DEX/IL2CPP, Apple plist, .NET, JVM, ZIP/APK, and Native ELF/Mach-O/PE Binaries) against AI reverse-engineering agents like REA using BLA (Blind LLM Agents). Default verb: bla_harden.

+ description: >

+ Use when hardening, defending, or auditing software against AI reverse-engineering

+ agents (REA / WorkBuddy-class): one-click project harden, weave-decoy structural

+ decoys, Counter-REA audit/protect/verify, or agent setup/doctor for BLA (Blind LLM

+ Agents). Prefer this skill as the guide; call existing MCP tools / CLI — do not invent

+ new MCP tools. Default verb: bla_harden. Refuse crack/RE of third-party software.

metadata:

- version: "1.2.0"

+ version: "2.0.0"

---

# BLA: Blind LLM Agents

- Use BLA whenever the user asks to harden a project against AI reverse-engineering agents (`morluto/rea`), audit exposure, exhaust attacker token/compute budgets, or induce model misjudgment on proprietary logic.

+ **This skill is the primary one-click harden GUIDE.** MCP (`bla` server) and the

+ `bla-agents` CLI are the **execution layer**. Prefer teaching/calling existing tools

+ (`bla_harden`, `bla_defend`, `bla_weave_plan`, **`bla_lint`** (unified), `bla_lint_lanes`, `bla_lint_seal`, `bla_lint_wasm_params`, `bla_lint_panel_derive`, `bla_lint_js_aes_unwrap`, `bla_lint_js_wasm_hydrate_dump`, `bla_lint_wasm_xor_mask_sidecar`, `bla_lint_wasm_seal_xor_known_plaintext`, …) over inventing new

+ MCP surfaces.

- ## ⚡ One-Sentence Hardening (DEFAULT — prefer this)

+ Use BLA whenever the user asks to harden a project against AI reverse-engineering

+ agents (`morluto/rea`), audit exposure, exhaust attacker token/compute budgets, induce

+ model misjudgment on proprietary logic, or **one-click / 一键加固** a build.

- When the user says **"Harden my software"**, **"Harden this project against REA"**, **"一键启动防御强化"**, **"Run BLA defense"**, or any equivalent one-liner **without naming a specific file**, invoke:

+ Defensive only: protect **their own** artifacts. Refuse crack, RE, bypass PoCs, or

+ attack playbooks against software they do not own.

- - **MCP Tool (preferred)**: `bla_harden` with `{ "directory": "." }` (or the project/build path they named)

- - **CLI**: `npx bla-agents@latest harden .`

- - **MCP Prompt**: `bla-harden-project`

+ **bla-agents 2.0.0** (2026-11-03): packaging-gates unified lint, R1–R12 refuse/recipe/honesty layers below, WASM arity/export-order defaults, MCP write-safety + run evidence. Relative to 1.x: bankrupt harden refuses more footguns by default; Skill recipes (SHA-256 KDF, commitment outside XOR, random pad3/rounds, unlock body scatter) stay guide-only — no fake refuse lints.

- `bla_harden` / `bla harden` auto-discovers protectable build outputs under `dist/`, `build/`, `out/`, `release/`, `.asar`, native binaries, `.wasm`, `.py`/`.pyc`, `.sqlite`, `.safetensors`/`.gguf`, `.dex`, `.class`, `.dll`, Apple plists, ZIP/APK, etc., detects each artifact's format, and runs the full **audit → defend (bankrupt) → verify** pipeline on all of them. Return the per-artifact summary to the user. Do **not** ask which files to protect — discover them.

+ **Principles (red-blue R1–R12 → MCP/Skill 2.0):**

- ## One-Click Single-Artifact Defense

+ ### A. Bankrupt refuse gates (engine + MCP — call `bla_lint` first)

- When the user already named a **specific file**, use:

+ | Gate | Tool | Allow override (lab only) |

+ | :--- | :--- | :--- |

+ | Independent lane tables | `bla_lint_lanes` | `allow_lane_independent` |

+ | Plaintext / reversible seal JSON | `bla_lint_seal` | `allow_plaintext_seal` |

+ | Clear WASM `R2SEAL`/`R3PARM`/`R3CIPH` | `bla_lint_wasm_params` | `allow_wasm_clear_params` |

+ | JS AES wrap-key + create*iv + fixed hdr | `bla_lint_js_aes_unwrap` | `allow_js_aes_unwrap` |

+ | Panel `deriveLocal` + `panelTokenSha256` oracle | `bla_lint_panel_derive` | `allow_panel_offline_oracle` |

+ | JS←WASM hydrate salt/rounds/cipher dump | `bla_lint_js_wasm_hydrate_dump` | `allow_js_wasm_hydrate_dump` |

+ | WASM XOR-mask beside masked pack | `bla_lint_wasm_xor_mask_sidecar` | `allow_wasm_xor_mask_sidecar` |

+ | `seal.revision` as XOR known-plaintext | `bla_lint_wasm_seal_xor_known_plaintext` | `allow_wasm_seal_xor_known_plaintext` |

- - **MCP Tool**: `bla_defend` with `{ "input_path": "<target>", "intensity": "bankrupt", "emit_manifest": true }`

- - **CLI Command**: `npx bla-agents@latest defend <target> --manifest`

+ Prefer **one** project scan: MCP `bla_lint` / CLI `bla lint .` (schema `bla-packaging-gates/v1`). Individual `bla_lint_*` remain for single-file drills. Bankrupt harden **refuses** the six carrier/JS/WASM gates unless the matching allow flag is set; lanes/panel also refuse at protect-time.

- `bla_defend` / `bla defend` executes all 5 Counter-REA defense stages automatically:

- 1. **Stage 1 (`inspect-release`)**: Read-only scan for accidental `.map` (`sourcesContent`) and symbol leaks.

- 2. **Stage 2 (`audit`)**: 16-vector REA vulnerability & Claude Opus 4 / Sonnet 4 / o3 token-cost simulation.

- 3. **Stage 3 (`protect --intensity bankrupt`)**: Injects both the **Resource-Exhaustion Suite** and the **Model-Misjudgment Induction Suite** (including canary honeypots + system-diagnostic decoys across JS, WASM, Python, SQLite, Safetensors/GGUF, DEX, IL2CPP, Apple plist, .NET, JVM, ZIP/APK).

- 4. **Stage 4 (`verify`)**: Verifies all Counter-REA mathematical invariants and confirms token/cost bankruptcy amplification.

- 5. **Stage 5 (`manifest`)**: Emits `<output>.bla-manifest.json` attesting to the hardened build.

+ Also: do **not** ship a stable public WASM ABI without explicit `wasm_preserve_exports`; maximum/bankrupt **rewrites** `__vaultPanelDerive_*` / `deriveLocal` unless `allow_stable_panel_derive`. Multi-artifact trees: bankrupt sets `selfSealRecommended` — prefer **`self_seal`** (sibling SHA-256 **hard-fail**; opaque-seed alone does not gate entitlement).

- ## Step-by-Step Granular Workflow: Audit -> Protect -> Verify

+ ### B. Product recipe principles (Skill layer — not new refuse lints)

- 1. **Audit (`bla_audit` or `npx bla-agents audit <target>`)**:

- - Reports the **REA Exposure Score (0–100)**, exposed functions/classes/IPC channels/routes, and estimated attacker token and dollar costs.

- 2. **Protect (`bla_protect` or `npx bla-agents protect <target> -o <output> --intensity bankrupt`)**:

- - **Resource Exhaustion (耗尽对方资源)** and **Model Misjudgment Induction (诱导模型误判)** as documented in [references/counter-rea-matrix.md](references/counter-rea-matrix.md).

- 3. **Verify (`bla_verify` or `npx bla-agents verify <protected> [original]`)**:

- - Confirms that all Counter-REA gates pass and reports exact Token & API Cost Amplification.

+ Held across R8–R12 (NO PRIZE). Keep in gate design; do **not** invent packaging refuse lints for these:

- ## CLI Fallback Commands

+ - Unlock **inside WASM** (`unlock(keyPtr,keyLen)->outLen`); JS only writes key / reads result UTF-8.

+ - Mask via **one-way** KDF (`SHA-256(key[16])`), never algebraically invertible byte mix.

+ - Keep public digests (**`seal.revision`**) **out** of XOR-masked plaintext; commitment in a separate clear segment.

+ - Randomize pack header `pad3` + seed-derived rounds (close structural KP).

+ - Keep the **crypto schedule / harden seed private** (derive from release secrets); a public `seed` in SEAL re-opens header KP and strips the mask without WASM RE. Publish only `flagSha256`/`certificateSha256` for prove-solve — **never** `keySha256` (offline key oracle). `bla_lint` warns (`public-materialization-seed`, `public-key-digest-oracle`); warning only, not a refuse gate.

+ - Host resolves unlock by **arity + `FLAG{…}` shape + `sha256===certificateSha256`**, never export name/order.

+ - JS honeypot/canary ≠ WASM unlock (decoy must fail certificate check).

+ ### C. Engine defaults already on (hygiene, not refuse)

+ At maximum/bankrupt WASM protect: export rename, **arity-2-preferring decoy alias spread**, **independent export-order shuffle**, honesty fields `wasmExportRenameApplied` / `wasmExportOrderShuffled` / `wasmExportDecoysInjected`. Cleartext may also scatter unlock body index (recipe).

+ ### D. Honesty residual (do not water refuse lints)

+ Gates close **packaging** footguns. They do **not** claim white-box secrecy against full WASM RE + online/SMT vs SHA-256 commitment (R8–R12 P2). Body-size fingerprinting among arity-2 exports is P3 / diminishing returns — not a new refuse gate. `defenseScore` is an honest soft-cap, not preimage hardness.

+ ## Prerequisites (once)

+ 1. CLI: `npx bla-agents@latest setup`

+ 2. Then: `npx bla-agents@latest doctor` (or MCP `bla_doctor`) — checks the installed

+ skill bundle (this file + `references/`, including format appendices) is complete

+ ## ⚡ One-Sentence Hardening (DEFAULT)

+ When the user says **"Harden my software"**, **"一键加固"**, or any equivalent one-liner

+ **without naming a specific file**:

+ | Surface | Call |

+ | :--- | :--- |

+ | **MCP (preferred)** | `bla_harden` `{ "directory": "." }` |

+ | **CLI** | `npx bla-agents@latest harden .` |

+ | **MCP Prompt** | `bla-harden-project` |

+ Auto-discovers protectable build outputs, detects formats, runs **audit → defend

+ (bankrupt) → verify**. **Do not ask which files to protect — discover them.**

+ Optional args (safe defaults): `intensity` (bankrupt), `emit_manifest` (false),

+ `llm_directives` (false — risky bait), `weave_decoys` (false), `self_seal` (false),

+ `wasm_preserve_exports`, `seed`, `output_directory`, `max_artifacts`, `dry_run`.

+ ## Write safety (principles)

+ - Unsure what will be touched? `bla_discover` or `bla_harden` `{ "dry_run": true }` —

+ both write nothing. If `truncated: true`, say so and narrow the directory.

+ - Never overwrite without the user's go-ahead. On `confirmation_required`, show

+ `wouldOverwrite`, ask, then retry with `confirm_overwrite: true` (or a new path).

+ Same rule for `in_place: true` (overwrites the input).

+ - Report writes from the tool receipt (`writeReceipt` / `wouldOverwrite`), not guesses.

+ - After a successful harden/defend/protect, keep the returned unsigned `runId` (and

+ harden `summaryPath`). Re-check later with `bla_run_lookup` or `bla_verify` +

+ `summary_path`/`run_id` — never invent a run id.

+ - `bla_rea_drift` / `bla_redteam_report` may return `status: unverified` when sibling

+ REA is absent; treat that as **not proven**, never as a pass. An on-disk

+ `bla_redteam_report` without `execute:true` is `status: available` — readable

+ evidence, not a fresh REA verdict.

+ - `bla_harden` `{ "dry_run": true }` always has `overallSuccess: false`; only real

+ writes return `writeReceipt`.

+ ## Decision tree (short)

+ | Intent | Prefer |

+ | :--- | :--- |

+ | Project / build dir | **`bla_harden`** |

+ | Named artifact | **`bla_defend`** (or granular `bla_audit` → `bla_protect` → `bla_verify`) |

+ | Inventory only | **`bla_discover`** |

+ | Structural decoys (esp. Python) | Resource `bla://directives/weave-decoy` → `bla_weave_plan` → `weave_decoys: true` |

+ | Packaging footguns before harden (entitlement tree) | **`bla_lint`** `{ "directory": "." }` (CLI: `bla lint .`) — unified R1–R7+lanes/panel |

+ | Custom license/activation gate review | **`bla_lint_lanes`** `{ "path": "<gate.js>" }` (CLI: `bla lint-lanes`) |

+ | Re-check a prior harden run | **`bla_run_lookup`** `{ "summary_path": "<.bla-hardened or summary.json>", "run_id": "…" }` |

+ | REA constant drift / empirical report | **`bla_rea_drift`** / **`bla_redteam_report`** (unverified if REA absent; on-disk read → available) |

+ | Format-specific knobs | Load the matching appendix under `references/` |

+ ## FORBIDDEN

+ Do **not**: add dismissible noise / greppable `BLA-SHIELD` banners / empty honeypot

+ stubs; drive hardening via a **rule engine** (business-name → fixed snippets); help

+ crack, RE, bypass, or write offensive PoCs against third-party software.

+ If asked for offensive RE/crack help: refuse briefly; offer defensive harden of

+ **their** artifacts instead.

+ ## Format appendices (load on demand)

+ | Format | Appendix |

+ | :--- | :--- |

+ | JS / TS / Electron | [references/format-javascript.md](references/format-javascript.md) |

+ | WebAssembly | [references/format-wasm.md](references/format-wasm.md) |

+ | Python `.py` / `.pyc` | [references/format-python.md](references/format-python.md) |

+ | Android DEX / APK / IL2CPP | [references/format-android.md](references/format-android.md) |

+ | REA ↔ BLA matrix | [references/counter-rea-matrix.md](references/counter-rea-matrix.md) |

+ ## CLI fallbacks

```bash

+ npx -y bla-agents@latest setup

+ npx -y bla-agents@latest doctor

npx -y bla-agents@latest harden .

+ npx -y bla-agents@latest harden . --weave-decoys --self-seal

+ npx -y bla-agents@latest lint .

+ npx -y bla-agents@latest lint-lanes path/to/gate.js

+ npx -y bla-agents@latest lint-js-wasm-hydrate-dump path/to/license.cjs

npx -y bla-agents@latest defend /absolute/path/to/target --manifest --json

- npx -y bla-agents@latest audit /absolute/path/to/target --json

- npx -y bla-agents@latest protect /absolute/path/to/target -o /absolute/path/to/protected --intensity bankrupt --json

npx -y bla-agents@latest verify /absolute/path/to/protected /absolute/path/to/target --json

- npx -y bla-agents@latest doctor

```

- See [references/counter-rea-matrix.md](references/counter-rea-matrix.md) for the complete mapping between REA's internal analyzers and BLA's countermeasures.

+ ## References

+ - Weave directives (after MCP setup): resource `bla://directives/weave-decoy`

+ - One-click UX notes (repo checkout): `docs/one-click-agent-defense.md`

+ - CLI / MCP parameter index (repo checkout): `docs/cli-and-mcp.md`