Nightmare Obfuscator v0.1.0

Nightmare is CDLI's defensive IP-protection tool for controlled collaboration. It produces a working, obfuscated copy of a Rust project while you keep the original source. Every output ships with a locked metadata vault — checksums, owner/project metadata, configuration, and an integrity signature — so a drop to an agency, vendor, or external team is reproducible and verifiable instead of a leap of faith.

This first public release establishes the core: a build-preserving Rust obfuscator and a machine-readable run contract.

What's in v0.1.0

• Build-preserving Rust obfuscation — identifier renaming and dead-code injection over a real tree-sitter AST, with the mangled output validated to re-parse. Non-Rust files are copied byte-for-byte.
• Metadata vault & provenance — every output carries .nightmare/manifest.json and .nightmare/signature, signed with Ed25519. nightmare verify detects tampering; with a trusted public key it also establishes owner identity.
• Staged run contract — a versioned nightmare.toml plus a machine-readable result that separates obfuscation, metadata verification, and build/smoke checks, so CI and agents never mistake a valid manifest for a building output.
• Terminal shell (TUI) — a CDLI-branded entry surface for the local obfuscation flow.
• Opt-in string encryption — std-only and build-preserving; disabled by default.

Scope (deliberately narrow)

V1 is Rust-only. It performs one-way obfuscation — the original repository stays the source of truth — and makes no deobfuscation or source-recovery promise. Control-flow flattening ships documented as experimental and is a no-op until a build-preserving implementation lands. We would rather ship a narrow tool that does exactly what it says than a broad one that overclaims.

Install

cargo install --git https://github.com/cdliai/nightmare-obfuscator

Or download a binary and its .sha256 checksum from the assets below — Linux (x86_64) and macOS (aarch64).

For teams

The open-source core covers protecting a Rust drop locally. Organization-wide rollout — hosted accounts, policy and governance, multi-language coverage, and integration with your existing toolchains and agent harnesses — is the conversation we have at CDLI.ai, independent of the languages and tooling you already run.