bla-agents v1.4.2

Patch: stop CI from treating an absent sibling REA as "this repo".

Fixed

• verify:rea empty REA_ROOT — GitHub Actions sets REA_ROOT="" when REA is not checked out. The old ?? fallback kept the empty string, so resolve("") became the BLA workspace and the harness walked BLA's own source looking for REA constants (bogus parse failures that only showed up after the 1.4.1 typecheck fix).
• CI workflow — verify:rea now guards on steps.rea.outputs.present the same way redteam:rea already did.
• redteam paths — same empty-env treatment.

Verified locally: typecheck + 202 / 202 tests; empty/BLA_ROOT REA_ROOT soft-skip; real sibling still 42/42 PASS.

bla-agents v1.4.1

Patch release: green the CI pipeline.

Fixed

• CI typecheck — the v1.4.0 anti-strip work added hardenProject to the McpEngineHandlers contract, but a test spy mock in tests/setup-mcp-doctor-release.test.ts omitted it. Local vitest does not typecheck, so it slipped past and failed CI's tsc --noEmit step. The spy now includes hardenProject.

Full CI sequence (typecheck + build + test + benchmark) verified locally on Node 24.22.1: 202 / 202 tests, 612.5× aggregate benchmark, 14/14 runtime-equivalent.

See CHANGELOG.md.

bla-agents v1.4.0

bla-agents v1.4.0 — Release notes

Publish checklist (run ONLY after a GitHub token is configured)

Do not run this sequence until gh auth status (or GITHUB_TOKEN /
GH_TOKEN) succeeds. Remotes and tags are intentionally untouched in the
staging commits.

# 0. Confirm auth
gh auth status
# optional if git HTTPS needs the credential helper:
gh auth setup-git

# 1. From a clean tree on main, with local commits already at 1.4.0:
cd /path/to/bla
git status   # should be clean; version 1.4.0 already committed

# 2. Push main (does not create the release tag yet)
git push origin main

# 3. Create and push the annotated release tag
git tag -a bla-agents-1.4.0 -m "bla-agents v1.4.0"
git push origin bla-agents-1.4.0

# 4. Publish the GitHub Release from this file
gh release create bla-agents-1.4.0 \
  --title "bla-agents v1.4.0" \
  --notes-file docs/releases/v1.4.0.md

# Optional: also publish npm tarballs if that pipeline is wired
# npm run release:minor   # DO NOT use — that would bump past 1.4.0 and push

---

Headline numbers

Gate	Result
Tests (Node 22.23.4)	202 / 202 pass
Tests (Node 24.22.1)	202 / 202 pass
npm run verify:rea	42 drift checks (NOT protection proof)
npm run redteam:rea (Node 24 + Wabt)	real-REA budget/exception hits across Go, Flutter, BEAM, EVM, PCAP, GGUF, Safetensors, ASAR, WASM, SQLite, Electron fuses and JavaScript (alias-selections+getter-expansion+primitive-bytes+primitive-candidates); GPU-PTX still soft (after=ok, not inflated)
Anti-strip gate	4 / 4 — hardened 790 B sample: `grep -v '_bla
14-target benchmark (internal estimate, NOT red-team proof)	~612× aggregate token amplification · 100% runtime-equivalent on all 14
Native ELF showcase multiplier	~105.6× (ISO_SIZE 48 KiB)
ASAR after harden	~17.8 MiB header past DEFAULT_ASAR_MAX_HEADER_BYTES
WASM after harden	~6.88 MiB · 251 exports · Wabt ifaceState=partial
SQLite after harden (Node 24)	57 344 B · 5 honey tables · SqliteColumnEvaluationFailure on trap columns
Safetensors after harden	10 328 B · MODEL_JSON_NESTING · HF-loadable

What's new since v1.3.0

• Drift harness — verify:rea tracks REA constant movement; authoritative evidence is redteam:rea only.
• Graceful Node degradation when node:sqlite is missing.
• Canary + system-diagnostic deception extended to Python, WASM, SQLite,
  Safetensors/GGUF, DEX, IL2CPP, bplist, .NET, JVM, ZIP/APK.
• New domains: Go buildinfo, Flutter pool, BEAM, EVM, PCAP, GPU-PTX.
• bla_harden one-sentence UX with auto-discovery (CLI + MCP).
• Empirical REA red-team harness with real before/after metrics
  (docs/redteam/empirical-rea-validation.{md,json}).
• 14-target Counter-REA benchmark.
• Launch-ready README with empirical-vs-estimate separation and honest
  coverage matrix.
• STATE.md + dogfood polish: root-level harden discovery, CLI Quick start.

Empirical validation highlights (real REA)

Recorded under Node v24.22.1 with WABT 1.0.42 at
REA_WABT_BIN_DIRECTORY (soft-skips keep Node 22 / CI green when tooling is
absent):

SQLite (inspectSqliteDatabaseSnapshot)

Phase	Input	REA outcome
before	12 288 B	ok — 1 table (license_cache), DatabaseSync.limits present
after	57 344 B	budget_rejected — SqliteColumnEvaluationFailure: unknown function bla_enclave_unseal() on _bla_enclave_key_hierarchy.unsealed_preview; 5 _bla_* honey tables disclosed in schema

Honey metadata does trip REA's SQLite redaction/column-evaluation path
under Node 24 (not merely the 16 MiB JSON reply budget). On Node 22 the probe
soft-skips as capability_gated.

WASM Wabt E2E (WabtArtifactProvider)

Phase	Input	Exports	Wabt interface	Outcome
before	54 B	1 (computeDigest)	state=complete, 1 entry, 222 B WAT	ok
after	6 878 763 B	251 (250 long-name decoys + original)	state=partial, 231 entries, 6 887 986 B WAT	budget_rejected — Typed WASM interface decoding exceeds the WABT output representation budget

Original computeDigest export, WebAssembly.validate, and execute remain
intact (red line held). Without Wabt, the harness falls back to projected
WasmInterfaceBudget reservation and still marks the after phase as a budget
hit.

Safetensors (readSafetensorsHeader / inspect_model_artifact)

Phase	Input	REA outcome
before	128 B	ok
after	10 328 B	capacity — MODEL_JSON_NESTING: Safetensors JSON nesting exceeds 32 levels

Extra bla_enclave_topology key on the first tensor descriptor; tensor bytes and
required fields preserved; HuggingFace safe_open loads the file.

Other empirical budget hits (same harness)

• Go buildinfo → MAX_BUILD_INFO_BYTES
• Flutter pool → MAX_POOL_URIS / MAX_POOL_TOKENS
• Erlang BEAM → max_chunks
• EVM bytecode → EVM_INTERFACE_LIMITS.inputBytes (approach)
• PCAP → TSHARK_JSON_MAX_BYTES
• GGUF → MODEL_METADATA_NESTING
• Electron ASAR → DEFAULT_ASAR_MAX_HEADER_BYTES
• Electron fuses → ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice

Install (once published)

npm i -g bla-agents@1.4.0
# or from the GitHub Release tarball

Compatibility

• Node.js ^22.23.4 (primary CI / engines) and 24.x (SQLite limits +
  empirical probes). Node 24.22.1 verified green this release.
• Optional tooling for full empirical coverage: tshark, Wabt 1.0.42
  (REA_WABT_BIN_DIRECTORY), sibling REA tree for verify:rea / redteam:rea.

Full changelog

See CHANGELOG.md.

bla-agents: v1.3.0

bla-agents v1.3.0 — Counter-REA Runtime Memory Diff & Rolling XOR Split-Share Shield

Highlights

• Synchronized Shadow Heap Churn (src/shields/runtime/memory-diff-shield.ts): Injects 16–64 mutable decoy state slots (aes256_round_key, license_quorum_lease, tpm2_pcr_quote_digest, enclave_session_ratchet) plus >28 mutable diffEnvelope fields that mutate in-place in $O(1)$ lockstep with every protected function invocation.
  • Defeats $M_0 \to M_1$ differential memory snapshot filtering in Frida, GDB, Rizin, and V8 Heap Snapshots.
  • Exceeds CPU hardware watchpoint limits (DR0–DR3 = 4 watchpoints) and REA's STEP_DIFFERENCE_LIMIT = 20 (src/application/environment/environmentCompareDiff.ts:52).
• Split-Share Rolling XOR Memory Masking (encodeSplitShareString & generateSplitShareRuntimeHelper): Splits sensitive strings into two non-adjacent numeric shares (shareA[i] ^ shareB[i]) and rolls both shares in-place via ^ _roll on every read or step, eliminating contiguous plaintext in RAM against Memory.scan() while keeping runtime outputs 100% invariant.
• Realm-Agnostic Frida Capture Saturation (src/shields/exhaustion/frida-capture-saturation.ts): Removes reliance on globalThis.Frida so decoy ring buffers and >64-depth JSON / >32 KiB message envelopes remain active even when Frida executes in its isolated Gum script realm or when out-of-process debuggers (GDB, Rizin) attach.
• Native Compile-Time .data Memory Churn (src/shields/formats/headers.ts): Adds mutable .data shadow heap arrays (_bla_shadow_heap_slots[32] in C/C++, BlaShadowHeapSlots in Go) to defeat native runtime memory diffing.
• REA Runtime Debugger Budget Matrix (src/identity.ts & src/shields/exhaustion/rea-budget-matrix.ts): Catalogs REA's exact LLDB_MAX_TRACE_BYTES (8 MiB), LLDB_MAX_TRACE_FRAMES (65,536), LLDB_MAX_OTHER_STOPS (256), GDB_MAX_COMMAND_OUTPUT_RECORDS (16,384), RIZIN_MAX_COMMAND_FRAMES (4,096), and ENVIRONMENT_COMPARE_STEP_DIFF_LIMIT (20).

bla-agents: v1.2.0

1.2.0 (bla-agents-1.1.0...bla-agents-1.2.0) (2026-10-26)

Highlights

• 22 Protected Artifact Formats & 10-Target Counter-REA Benchmark Suite: Expanded format-aware protection and verification across JavaScript/TypeScript, Electron .asar & Binary Fuses, WebAssembly .wasm, Python .py/.pyc, Native ELF64/Mach-O/PE, SQLite3, Safetensors/GGUF/ONNX AI Models, Android classes.dex, Unity Il2Cpp metadata, Apple Info.plist (XML/Binary), .NET Managed CLR Assemblies (.dll/.exe), JVM .class bytecode, and .zip/.tar archives.
• Fail-Closed Format Integrity & Carrier Preservation (#6, #7, #13–#17):
  • Safetensors & AI Models (#6): Preserves exact tensor payload bytes, validates contiguous [start, end] tensor spans, bounds numeric tokens before BigInt conversion, and rejects truncated or malformed model headers.
  • Archive & Container Safety (#7, #13): Rejects unsafe ZIP/archive rewrites (encrypted entries, traversal, parent-name collisions, capacity overflow) and unsupported APK protection; preserves custom ASAR node metadata, unpacked external files, and link entries while verifying non-overlapping file spans.
  • Python Lexical Prologue & JS/Bundler Carrier Contracts (#14, #15): Preserves multi-line module docstrings and from __future__ import statements in Python sources; preserves shebangs, "use strict" directives, ESM/CJS carrier semantics, and esbuild .ts/.tsx/.jsx/.mts/.cts loader selection.
  • ELF64 Memory Layout & Context-Verified Electron Fuses (#16, #17): Keeps ELF64 PT_LOAD segments, .bss p_memsz > p_filesz invariants, and section header offsets intact; requires verified Electron binary/bundle context before mutating V1 fuse wires.
• SQLite Consistency, Debug Posture & Server Authorization Coverage Contracts (#18–#21):
  • SQLite DB/WAL Consistency & Policy Separation (#18, #19): Detects active -wal/-shm sidecars, runs PRAGMA integrity_check with deterministic bla_enclave_unseal registration, and separates real sensitive column policy enforcement from honey-table decoration.
  • Production Debug Posture & Coverage Contracts (#20, #21): Adds read-only production debug exposure posture checker (inspectDebugPosture) and server-side authorization coverage verifier (verifyServerCoverageContract) with a reference multi-tenant verification service.
• Native MCP Client Adapters, Ownership-Checked Setup & Release Consistency (#8–#12):
  • Supports native config schemas for Codex (~/.codex/config.toml TOML [mcp_servers.bla]), VS Code (servers), OpenCode (mcp), Claude Code, Cursor, Windsurf, Gemini CLI, and Antigravity with non-clobbering backups and ownership-verified uninstall (~/.bla/install-manifest.json).
  • Full runtime MCP tool argument schema validation (-32602 on invalid parameters), prompts/get support, real bla doctor readiness checks (exitCode), and deterministic release/tarball SHA-256 verification (src/core/release-plan.ts).

Counter-REA Benchmark Summary (npx bla-agents benchmark)

• Aggregate Token Amplification: 881.5x across 10 benchmark targets (up to 2,630.2x on JS/License targets and 2,532.3x on Electron .asar)
• Aggregate Cost Multiplier: 371.1x ($0.20 -> $198.86+ per target)
• Runtime Output Equivalence: 100% Exact across all 10 targets (19 test suites / 166 automated tests passing)

bla-agents: v1.1.0

1.1.0 (2026-10-25)

Highlights

• Primary Counter-REA Package (bla-agents) + Alias Mirror (bla-shield): Supports one-line agent registration via npx bla-agents setup (1-to-1 counterpart to npx rea-agents setup) as well as npx bla-shield setup and bla.
• 19 Artifact Formats Protected: JavaScript/TypeScript, Electron .asar & Binary Fuses, Native ELF/Mach-O/PE (Rust, Go, Flutter/Dart AOT), WebAssembly .wasm, Python .py/.pyc, SQLite3, Safetensors/GGUF AI Models, Android classes.dex, Unity Il2Cpp metadata, and Compile-Time C/Rust/Go headers.
• 14 Deterministic REA Capacity & Evaluation Breakers: Trips primitive-candidates > 256, alias-selections > 512, getter-expansion > 512, primitive-bytes > 1 MiB, electron_call_paths_limited, MAX_RUSTC_HASHES > 64, maximumSentinelsPerSlice > 32, MAX_SNAPSHOT_HASH_CANDIDATES > 64, SqliteColumnEvaluationFailure, and MODEL_JSON_NESTING > 32 at zero runtime overhead.
• "Truman Show" Anti-CDP Runtime Shield & Bundler Plugins (bla-agents/bundler): Built-in Vite, Rollup, Webpack, and esbuild plugins plus runtime CDP/Inspector/Frida deception.

Changes

• Electron Fuse Hardening & Sentinel Overflow (src/shields/formats/electron-fuses.ts): Hardens V1 fuse wires in-place (RunAsNode=0, EnableNodeCliInspectArguments=0, EnableEmbeddedAsarIntegrityValidation=1) and appends 34 decoy fuse sentinels (> 32 REA slice limit).
• SQLite3 Honey Tables & Virtual Generated Column Trap (src/shields/formats/sqlite.ts): Injects 3 enclave honey tables with GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL columns that abort REA's read-only inspector while keeping application tables 100% queryable.
• Safetensors & GGUF Model Header Shield (src/shields/formats/model.ts): Embeds 35-level nested JSON/ARRAY headers exceeding REA's MODEL_JSON_NESTING = 32 and MODEL_METADATA_NESTING = 32 limits.
• Android Dalvik DEX & Unity IL2CPP Shield (src/shields/formats/mobile-game.ts): Injects decoy enclave classes into classes.dex with recomputed SHA-1 and Adler32 checksums.

Counter-REA Benchmark Summary (npx bla-agents benchmark)

• Aggregate Token Amplification: 968.8x (up to 2,532.3x on Electron .asar and 2,121.3x on DX-Ball JS)
• Runtime Output Equivalence: 100% Exact across all 8 showcase targets (0 ms runtime overhead)