Blekline uses one field — maskBackend — so clients cannot accidentally call hosted /api/mask while also using an in-cluster sidecar.
| Backend | Plan shell | Where mask runs | Hosted /api/mask |
|---|---|---|---|
local | Free / local | IDE hooks + stdio MCP | No |
hosted | Standard | Blekline cloud proxy | Yes (100k units / mo) |
sidecar | Fleet / in-VPC | NHIM sidecar in your cluster | Never |
Policy file
.blekline/policy.json:
{
"maskBackend": "local",
"apiUrl": "https://app.blekline.com",
"workspaceToken": "blw_..."
}
Set via init:
npx @blekline/init --path local # maskBackend local
npx @blekline/init --path hosted # maskBackend hosted
npx @blekline/init --path fleet # maskBackend sidecar
npx @blekline/init --path in_vpc # maskBackend sidecar
Or explicitly: --mask-backend local|hosted|sidecar.
Cursor hooks
.blekline/cursor.json is derived from maskBackend:
| Backend | promptMaskSource | Notes |
|---|---|---|
| local / sidecar | local | Sidecar may set sidecarUrl from BLEKLINE_SIDECAR_URL |
| hosted | cloud | Calls hosted mask API |
Native Cursor chat stays block + clipboard — not silent auto-send — on every backend.