blun-king-cli 9.1.5 → 9.1.8

package/bin/launcher-mode.js

@@ -11,6 +11,7 @@ const LAUNCHER_HELP_TEXT = [
   '  blun  Starts the CLI without automatically attaching Telegram.',
   '  king  Starts the same CLI and automatically attaches the configured Telegram channel.',
   '  Both use the same version, account, model, and commands.',
+  '  blun tools list shows optional tools; enable writes only explicit choices.',
   '',
 ].join('\n');
 

package/bin/launcher-runtime.js

@@ -16,13 +16,17 @@ const {
   launcherModeFromArgv,
 } = require('./launcher-mode');
 const { installManagedTelegramPlugin } = require('./plugin-bootstrap');
+const {
+  availableStandardToolNames,
+  seedStandardDesignSkill,
+  seedStandardTools,
+} = require('./standard-tools-bootstrap');
 const { CORE_LOADED_MESSAGE } = require('./core-bootstrap');
 const { tryAcquireUpdateLease } = require('./update-lease');
 const { runExplicitUpdate, runUpdateNotice } = require('./update-notice');
 const {
   ensurePrivateDirectory,
   securePrivateFile,
-  securePrivateTree,
   writePrivateFile,
 } = require('./private-paths');
 
@@ -164,10 +168,25 @@ function exitCodeForChild(result, loaded) {
   return 1;
 }
 
+function installTelegramForProfile(packageRoot, blunDir) {
+  installManagedTelegramPlugin({ packageRoot, blunDir });
+  const channelsDir = path.join(blunDir, 'channels');
+  const channelDir = path.join(channelsDir, 'telegram');
+  ensurePrivateDirectory(channelsDir);
+  ensurePrivateDirectory(channelDir);
+  const envFile = path.join(channelDir, '.env');
+  if (!fs.existsSync(envFile)) {
+    writePrivateFile(envFile, 'BLUN_TELEGRAM_BOT_TOKEN=HIER_DEIN_BOT_TOKEN_EINFUEGEN\n');
+  } else {
+    securePrivateFile(envFile);
+  }
+}
+
 async function runLauncher(options = {}) {
   const callerCwd = process.cwd();
   const mode = options.mode || launcherModeFromArgv(process.argv);
   const explicitUpdateRequest = isNpmPackageUpdateRequest(ARGS);
+  const explicitToolsRequest = String(ARGS[0] || '').toLowerCase() === 'tools';
   const noticeResult = options.noticeLease
     ? { acquired: true, lease: options.noticeLease }
     : await tryAcquireUpdateLease({ packageRoot: PKG, role: 'notice' });
@@ -197,6 +216,40 @@ async function runLauncher(options = {}) {
     }
     await installProbe.lease.release();
 
+    if (explicitToolsRequest) {
+      const action = String(ARGS[1] || '').toLowerCase();
+      const available = availableStandardToolNames({ packageRoot: PKG });
+      if (action === 'list' && ARGS.length === 2) {
+        process.stdout.write(`${available.join('\n')}\n`);
+        return;
+      }
+      if (action === 'enable' && ARGS.length > 2) {
+        const privatePaths = resolveLauncherPrivatePaths();
+        const selected = [...new Set(ARGS.slice(2))];
+        const unknown = selected.find((name) => !available.includes(name));
+        if (unknown) {
+          process.stderr.write(`Unbekanntes Standard-Tool: ${unknown}\n`);
+          process.exitCode = 1;
+          return;
+        }
+        const mcpNames = selected.filter((name) => name !== 'telegram');
+        if (mcpNames.length > 0) {
+          seedStandardTools({
+            packageRoot: PKG,
+            blunDir: privatePaths.blunHome,
+            names: mcpNames,
+          });
+        }
+        if (selected.includes('telegram')) {
+          installTelegramForProfile(PKG, privatePaths.blunHome);
+        }
+        process.stdout.write(`${selected.join('\n')}\n`);
+        return;
+      }
+      process.stderr.write('Usage: blun tools list | blun tools enable <name...>\n');
+      process.exitCode = 1;
+      return;
+    }
     if (ARGS.some((arg) => arg === '--version' || arg === '-V')) {
       process.stdout.write(`${readPackageVersion()}\n`);
       return;
@@ -253,37 +306,15 @@ async function runLauncher(options = {}) {
     const cfgFile = path.join(blunDir, 'config.toml');
     if (fs.existsSync(cfgFile)) securePrivateFile(cfgFile);
 
-  // --- 3. Telegram-Plugin + Token-Vorlage (nur King) -----------------------
-    if (mode === LAUNCHER_MODES.KING) {
-      installManagedTelegramPlugin({ packageRoot: PKG, blunDir });
-      const channelsDir = path.join(blunDir, 'channels');
-      const channelDir = path.join(channelsDir, 'telegram');
-      ensurePrivateDirectory(channelsDir);
-      ensurePrivateDirectory(channelDir);
-      const envFile = path.join(channelDir, '.env');
-      if (!fs.existsSync(envFile)) {
-        writePrivateFile(envFile, 'BLUN_TELEGRAM_BOT_TOKEN=HIER_DEIN_BOT_TOKEN_EINFUEGEN\n');
-      } else {
-        securePrivateFile(envFile);
-      }
-    }
+  // --- 3. Eigenes BLUN-Grunddesign als einzigen Standard-Skill installieren
+    seedStandardDesignSkill({ packageRoot: PKG, blunDir });
 
-  // --- 3b. Built-in-Skills installieren (fehlende ergaenzen, nie
-  //         vorhandene ueberschreiben — User-Anpassungen bleiben) -----------
-    const skillsSrc = path.join(PKG, 'skills');
-    const skillsDst = path.join(blunDir, 'skills');
-    if (fs.existsSync(skillsSrc)) {
-      if (fs.existsSync(skillsDst)) securePrivateTree(skillsDst);
-      else ensurePrivateDirectory(skillsDst);
-      for (const entry of fs.readdirSync(skillsSrc)) {
-        const dst = path.join(skillsDst, entry);
-        if (!fs.existsSync(dst)) {
-          fs.cpSync(path.join(skillsSrc, entry), dst, { recursive: true });
-        }
-      }
+    // --- 4. Telegram-Plugin + Token-Vorlage (nur King) -----------------------
+    if (mode === LAUNCHER_MODES.KING) {
+      installTelegramForProfile(PKG, blunDir);
     }
 
-    // --- 4. Start -----------------------------------------------------------
+    // --- 5. Start -----------------------------------------------------------
     const env = createLauncherEnvironment(process.env, mode, readPackageVersion());
     env.BLUN_HOME = blunDir;
     env.BLUN_MODEL_MAX_COMPLETION_TOKENS = env.BLUN_MODEL_MAX_COMPLETION_TOKENS || '32768';

package/bin/standard-tools-bootstrap.js

@@ -0,0 +1,218 @@
+'use strict';
+
+const { randomUUID } = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const {
+  ensurePrivateDirectory,
+  securePrivateFile,
+  securePrivateTree,
+  writePrivateFile,
+} = require('./private-paths');
+
+function isObject(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function readCatalogue(packageRoot) {
+  const manifestPath = path.join(packageRoot, 'standard-tools', 'manifest.json');
+  const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (!isObject(parsed) || parsed.version !== 1 || !isObject(parsed.tools)) {
+    throw new Error(`Ungueltiger Standard-Tools-Katalog: ${manifestPath}`);
+  }
+  for (const [name, tool] of Object.entries(parsed.tools)) {
+    if (!isObject(tool) || !Array.isArray(tool.detectTokens)
+      || !tool.detectTokens.every((token) => typeof token === 'string' && token.length > 0)) {
+      throw new Error(`Ungueltiger Standard-Tool-Eintrag: ${name}`);
+    }
+    if (tool.platforms !== undefined
+      && (!Array.isArray(tool.platforms)
+        || !tool.platforms.every((platform) => platform === 'darwin' || platform === 'win32'))) {
+      throw new Error(`Ungueltige Standard-Tool-Plattform: ${name}`);
+    }
+    if (tool.owner === 'user-mcp'
+      && (!isObject(tool.config) || typeof tool.config.enabled !== 'boolean')) {
+      throw new Error(`Standard-Tool braucht einen Aktivierungszustand: ${name}`);
+    }
+  }
+  return parsed;
+}
+
+function readMcpDocument(configPath) {
+  if (!fs.existsSync(configPath)) return { mcpServers: {} };
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  } catch (error) {
+    throw new Error(`Ungueltige MCP-Konfiguration (JSON): ${configPath}`, { cause: error });
+  }
+  if (!isObject(parsed) || (parsed.mcpServers !== undefined && !isObject(parsed.mcpServers))) {
+    throw new Error(`Ungueltige MCP-Konfiguration: ${configPath}`);
+  }
+  return parsed.mcpServers === undefined ? { ...parsed, mcpServers: {} } : parsed;
+}
+
+function serverSearchText(name, config) {
+  const values = [name];
+  if (isObject(config)) {
+    if (typeof config.command === 'string') values.push(config.command);
+    if (Array.isArray(config.args)) {
+      values.push(...config.args.filter((value) => typeof value === 'string'));
+    }
+    if (typeof config.url === 'string') values.push(config.url);
+  }
+  return values.join('\n').toLowerCase();
+}
+
+function hasEquivalentServer(servers, name, tool) {
+  if (Object.hasOwn(servers, name)) return true;
+  const tokens = tool.detectTokens.map((token) => token.toLowerCase());
+  return Object.entries(servers).some(([serverName, config]) => {
+    const searchText = serverSearchText(serverName, config);
+    return tokens.some((token) => searchText.includes(token));
+  });
+}
+
+function writeMcpDocument(configPath, document) {
+  const temporaryPath = path.join(
+    path.dirname(configPath),
+    `.${path.basename(configPath)}.${process.pid}.${randomUUID()}.tmp`,
+  );
+  try {
+    writePrivateFile(temporaryPath, `${JSON.stringify(document, null, 2)}\n`);
+    fs.renameSync(temporaryPath, configPath);
+  } catch (error) {
+    fs.rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+}
+
+function bundledToolConfig(name, tool, { packageRoot, blunDir, platform, env }) {
+  const config = structuredClone(tool.config);
+  config.enabled = true;
+  if (name === 'blun-language-guard') {
+    config.command = platform === 'win32' ? 'python' : 'python3';
+    config.args = [
+      path.join(
+        packageRoot,
+        'standard-tools',
+        'language-guard',
+        'blun_language_guard.py',
+      ),
+      'serve',
+    ];
+    config.env = {
+      ...(isObject(config.env) ? config.env : {}),
+      PYTHONDONTWRITEBYTECODE: '1',
+      PYTHONUTF8: '1',
+      BLUN_LANGUAGE_GUARD_KEY_FILE: path.join(
+        blunDir,
+        'secrets',
+        'blun-language-guard-signing.key',
+      ),
+    };
+  }
+  if (name === 'windows-mcp' && platform === 'win32') {
+    const localUvx = typeof env.USERPROFILE === 'string'
+      ? path.join(env.USERPROFILE, '.local', 'bin', 'uvx.exe')
+      : undefined;
+    config.command = localUvx !== undefined && fs.existsSync(localUvx) ? localUvx : 'uvx';
+  }
+  return config;
+}
+
+function availableStandardToolNames({
+  packageRoot,
+  platform = process.platform,
+}) {
+  const catalogue = readCatalogue(packageRoot);
+  return Object.entries(catalogue.tools)
+    .filter(([, tool]) => tool.owner === 'user-mcp' || tool.owner === 'managed-plugin')
+    .filter(([, tool]) => !Array.isArray(tool.platforms) || tool.platforms.includes(platform))
+    .map(([name]) => name);
+}
+
+function seedStandardTools({
+  packageRoot,
+  blunDir,
+  names,
+  platform = process.platform,
+  env = process.env,
+}) {
+  const catalogue = readCatalogue(packageRoot);
+  if (!Array.isArray(names) || names.length === 0) {
+    throw new Error('Mindestens ein Standard-Tool muss ausdruecklich ausgewaehlt werden.');
+  }
+  const selectedNames = [...new Set(names)];
+  for (const name of selectedNames) {
+    const tool = catalogue.tools[name];
+    if (!isObject(tool) || tool.owner !== 'user-mcp') {
+      throw new Error(`Unbekanntes Standard-Tool: ${name}`);
+    }
+    if (Array.isArray(tool.platforms) && !tool.platforms.includes(platform)) {
+      throw new Error(`Standard-Tool ist auf dieser Plattform nicht verfuegbar: ${name}`);
+    }
+  }
+  const configPath = path.join(blunDir, 'mcp.json');
+  ensurePrivateDirectory(blunDir);
+  if (fs.existsSync(configPath)) securePrivateFile(configPath);
+  const document = readMcpDocument(configPath);
+  const servers = { ...document.mcpServers };
+  const added = [];
+
+  for (const name of selectedNames) {
+    const tool = catalogue.tools[name];
+    if (hasEquivalentServer(servers, name, tool)) continue;
+    servers[name] = bundledToolConfig(name, tool, {
+      packageRoot,
+      blunDir,
+      platform,
+      env,
+    });
+    added.push(name);
+  }
+
+  if (added.length > 0) writeMcpDocument(configPath, { ...document, mcpServers: servers });
+  return { added, configPath };
+}
+
+function seedStandardDesignSkill({ packageRoot, blunDir }) {
+  const sourcePath = path.join(
+    packageRoot,
+    'standard-skills',
+    'blun-app-design-system',
+  );
+  const sourceStat = fs.lstatSync(sourcePath);
+  if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
+    throw new Error(`Ungueltiger BLUN-Standard-Skill: ${sourcePath}`);
+  }
+
+  const skillsDir = path.join(blunDir, 'skills');
+  ensurePrivateDirectory(skillsDir);
+  const destinationPath = path.join(skillsDir, 'blun-app-design-system');
+  const installed = !fs.existsSync(destinationPath);
+  if (!installed) {
+    const destinationStat = fs.lstatSync(destinationPath);
+    if (!destinationStat.isDirectory() || destinationStat.isSymbolicLink()) {
+      throw new Error(`Ungueltiges Ziel fuer BLUN-Standard-Skill: ${destinationPath}`);
+    }
+  } else {
+    ensurePrivateDirectory(destinationPath);
+  }
+
+  fs.cpSync(sourcePath, destinationPath, {
+    recursive: true,
+    force: true,
+    errorOnExist: false,
+  });
+  securePrivateTree(destinationPath);
+  return { installed, updated: !installed, destinationPath };
+}
+
+module.exports = {
+  availableStandardToolNames,
+  readCatalogue,
+  seedStandardDesignSkill,
+  seedStandardTools,
+};

package/bin/update-notice.js

@@ -620,10 +620,19 @@ function createInstallInvocation(version, options = {}) {
   if (platform !== 'win32' && path.basename(installPrefix) === 'lib') {
     installPrefix = path.dirname(installPrefix);
   }
-  let npmConfigPath;
-  if (options.npmConfigPath) {
-    npmConfigPath = fs.realpathSync(path.resolve(options.npmConfigPath));
-    if (!fs.statSync(npmConfigPath).isFile()) throw new Error('INVALID_NPM_CONFIG_PATH');
+  let npmUserConfigPath;
+  let npmGlobalConfigPath;
+  if (options.npmUserConfigPath || options.npmGlobalConfigPath) {
+    if (!options.npmUserConfigPath || !options.npmGlobalConfigPath) {
+      throw new Error('INVALID_NPM_CONFIG_PATHS');
+    }
+    npmUserConfigPath = fs.realpathSync(path.resolve(options.npmUserConfigPath));
+    npmGlobalConfigPath = fs.realpathSync(path.resolve(options.npmGlobalConfigPath));
+    if (!fs.statSync(npmUserConfigPath).isFile()
+      || !fs.statSync(npmGlobalConfigPath).isFile()
+      || npmUserConfigPath === npmGlobalConfigPath) {
+      throw new Error('INVALID_NPM_CONFIG_PATHS');
+    }
   }
   return {
     command: execPath,
@@ -638,16 +647,21 @@ function createInstallInvocation(version, options = {}) {
       '--ignore-scripts=false',
       '--package-lock-only=false',
       `--prefix=${installPrefix}`,
-      ...(npmConfigPath ? [
-        `--userconfig=${npmConfigPath}`,
-        `--globalconfig=${npmConfigPath}`,
+      ...(npmUserConfigPath ? [
+        `--userconfig=${npmUserConfigPath}`,
+        `--globalconfig=${npmGlobalConfigPath}`,
       ] : []),
     ],
     windowsVerbatimArguments: false,
   };
 }
 
-function createInstallEnvironment(sourceEnv, installDirectory, npmConfigPath) {
+function createInstallEnvironment(
+  sourceEnv,
+  installDirectory,
+  npmUserConfigPath,
+  npmGlobalConfigPath,
+) {
   const allowedKeys = new Set([
     'appdata',
     'comspec',
@@ -685,8 +699,8 @@ function createInstallEnvironment(sourceEnv, installDirectory, npmConfigPath) {
   result.npm_config_dry_run = 'false';
   result.npm_config_ignore_scripts = 'false';
   result.npm_config_package_lock_only = 'false';
-  result.npm_config_userconfig = npmConfigPath;
-  result.npm_config_globalconfig = npmConfigPath;
+  result.npm_config_userconfig = npmUserConfigPath;
+  result.npm_config_globalconfig = npmGlobalConfigPath;
   return result;
 }
 
@@ -763,7 +777,8 @@ function preparePinnedInstaller(version, options = {}) {
     let closeSettled = false;
     let selectedAction;
     let installDirectory;
-    let npmConfigPath;
+    let npmUserConfigPath;
+    let npmGlobalConfigPath;
     let disconnectTimer;
     const close = Promise.withResolvers();
     const closePromise = close.promise;
@@ -848,9 +863,15 @@ function preparePinnedInstaller(version, options = {}) {
         resolveInstallTempRoot(options),
         options.blunDir,
       );
-      npmConfigPath = path.join(installDirectory, 'npmrc');
-      writePrivateFile(npmConfigPath, '');
-      invocation = createInstallInvocation(version, { ...options, npmConfigPath });
+      npmUserConfigPath = path.join(installDirectory, 'user-npmrc');
+      npmGlobalConfigPath = path.join(installDirectory, 'global-npmrc');
+      writePrivateFile(npmUserConfigPath, '');
+      writePrivateFile(npmGlobalConfigPath, '');
+      invocation = createInstallInvocation(version, {
+        ...options,
+        npmUserConfigPath,
+        npmGlobalConfigPath,
+      });
       child = forkImpl(path.join(__dirname, 'update-lease.js'), ['--installer-worker'], {
         detached: true,
         execPath: invocation.command,
@@ -858,7 +879,8 @@ function preparePinnedInstaller(version, options = {}) {
         env: createInstallEnvironment(
           options.env || process.env,
           installDirectory,
-          npmConfigPath,
+          npmUserConfigPath,
+          npmGlobalConfigPath,
         ),
         stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
         windowsHide: true,

package/blun.mjs

@@ -492529,8 +492529,10 @@ var AuthFlowController = class {
 			availableModels,
 			availableProviders
 		});
-		if (await this.refreshManagedAccountContext() === void 0) {
-			this.enterLoginRequiredStartupState();
+		const accountContext = await this.refreshManagedAccountContextResult();
+		if (accountContext.kind !== "ready") {
+			if (accountContext.kind === "unauthenticated") this.enterLoginRequiredStartupState();
+			else this.enterManagedAccountUnavailableStartupState(accountContext.kind);
 			return;
 		}
 		if (selected === void 0) return;

package/package.json

@@ -1,48 +1,51 @@
-{
-  "name": "blun-king-cli",
-  "version": "9.1.5",
-  "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
-  "license": "MIT",
-  "bin": {
-    "blun": "bin/blun.js",
-    "king": "bin/king.js"
-  },
-  "scripts": {
-    "test": "node --test test/*.test.js",
-    "postinstall": "node scripts/fix-node-pty-perms.js"
-  },
-  "engines": {
-    "node": ">=24.15.0"
-  },
-  "os": [
-    "darwin",
-    "win32"
-  ],
-  "cpu": [
-    "x64",
-    "arm64"
-  ],
-  "dependencies": {},
-  "optionalDependencies": {
-    "@mariozechner/clipboard": "^0.3.9",
-    "node-pty": "^1.1.0"
-  },
-  "files": [
-    "bin/",
-    "blun.mjs",
-    "dist-web/",
-    "native/",
-    "scripts/fix-node-pty-perms.js",
-    "telegram-plugin/",
-    "LIESMICH.txt",
-    "skills/"
-  ],
-  "keywords": [
-    "blun",
-    "ai",
-    "agent",
-    "cli",
-    "assistant"
-  ],
-  "author": "BLUN / Mayk Biletti"
+{
+    "name":  "blun-king-cli",
+    "version":  "9.1.8",
+    "description":  "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
+    "license":  "MIT",
+    "bin":  {
+                "blun":  "bin/blun.js",
+                "king":  "bin/king.js"
+            },
+    "scripts":  {
+                    "test":  "node --test test/*.test.js",
+                    "postinstall":  "node scripts/fix-node-pty-perms.js"
+                },
+    "engines":  {
+                    "node":  "\u003e=24.15.0"
+                },
+    "os":  [
+               "darwin",
+               "win32"
+           ],
+    "cpu":  [
+                "x64",
+                "arm64"
+            ],
+    "dependencies":  {
+
+                     },
+    "optionalDependencies":  {
+                                 "@mariozechner/clipboard":  "^0.3.9",
+                                 "node-pty":  "^1.1.0"
+                             },
+    "files":  [
+                  "bin/",
+                  "blun.mjs",
+                  "dist-web/",
+                  "native/",
+                  "scripts/fix-node-pty-perms.js",
+                  "telegram-plugin/",
+                  "LIESMICH.txt",
+                  "standard-tools/",
+                  "standard-skills/"
+              ],
+    "keywords":  [
+                     "blun",
+                     "ai",
+                     "agent",
+                     "cli",
+                     "assistant"
+                 ],
+    "author":  "BLUN / Mayk Biletti"
 }

package/standard-skills/blun-app-design-system/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: blun-app-design-system
+description: Apply the canonical BLUN application design language to desktop and web product interfaces while preserving the current product structure, tokens, accessibility, and runtime behavior.
+---
+
+# BLUN App Design System
+
+Use this skill for BLUN application screens, components, dialogs, navigation, chat, workspaces, settings, and related product UI.
+
+## Source order
+
+1. Read the target project's current design tokens and nearby components.
+2. Treat the implemented product as authoritative. Read [references/tokens.md](references/tokens.md) for the verified baseline.
+3. Use the archived visual reference only as inspiration. Never copy its old palette, typography, product names, or CSS into a runtime.
+4. Preserve the existing information architecture and interaction model unless the task explicitly changes them.
+
+## Build rules
+
+- Use neutral dark and light surfaces with BLUN blue as the single primary accent.
+- Use Geist for UI text and JetBrains Mono for code, values, and terminal-like content.
+- Keep operational surfaces compact, predictable, and easy to scan. Use cards only for repeated items, dialogs, and genuinely framed tools.
+- Prefer semantic tokens over literal component colors. Extend both themes when a new semantic color is required.
+- Use familiar icons for actions, visible focus states, stable control dimensions, and reduced-motion fallbacks.
+- Keep text within its container at desktop and mobile widths. Do not size type directly from viewport width.
+- Preserve accessibility contrast, keyboard behavior, and native platform expectations.
+- Do not overwrite a product stylesheet with a bundled reference. Make focused edits in the target's existing source.
+
+## Verification
+
+Run `node scripts/check-blun-design.mjs <css-file>` from this skill directory for a token drift check. Then verify the actual interface in a real browser at representative desktop and mobile sizes. The token check is not a visual test.

package/standard-skills/blun-app-design-system/provenance.json

@@ -0,0 +1,17 @@
+{
+  "name": "blun-app-design-system",
+  "authority": "implemented-product",
+  "sources": {
+    "visualReference": {
+      "role": "historical-input-only",
+      "sha256": "F821EFEC89EB32628C3028F1FE34E83BF284B96E0FCFB6C647137DC93774DA64",
+      "normalizedCssSha256": "925260FBCC490B5C4EAC955ACD983BCCBF8FF35AFF8B1E374D1810C4D31FC83A"
+    },
+    "implementedProduct": {
+      "role": "authoritative",
+      "version": "1.0.110",
+      "file": "style.css",
+      "normalizedCssSha256": "956F156F9F944ED5AAB639C71C85A3989ABB6FC7505F17B3F7076E520781369F"
+    }
+  }
+}

package/standard-skills/blun-app-design-system/references/tokens.md

@@ -0,0 +1,48 @@
+# Canonical BLUN Tokens
+
+These values were verified against the current BLUN Code 1.0.110 product source. The target project's own newer implementation wins if it has intentionally advanced.
+
+## Core palette
+
+```css
+:root {
+  --bg-sidebar: #0a0a0b;
+  --bg-primary: #17181a;
+  --bg-secondary: #1f2022;
+  --bg-card: #1c1d1f;
+  --border: #2a2c2f;
+  --text-primary: #f4f4f5;
+  --text-secondary: #a6a7ab;
+  --text-muted: #76777b;
+  --brand: #0261ff;
+  --brand-text-dark: #4d8bff;
+  --brand-text-light: #0051d6;
+  --font: "Geist", "Inter Tight", "Segoe UI Variable Text", "Segoe UI", sans-serif;
+  --mono: "JetBrains Mono Variable", "JetBrains Mono", "Cascadia Code", Consolas, monospace;
+}
+
+:root[data-theme="light"] {
+  --bg-sidebar: #ececee;
+  --bg-primary: #ffffff;
+  --bg-secondary: #f6f6f7;
+  --bg-card: #fbfbfc;
+  --border: #e2e2e5;
+  --text-primary: #17181a;
+  --text-secondary: #57585c;
+  --text-muted: #8a8b90;
+}
+```
+
+## Shape and motion
+
+- Compact controls normally use 5-8 px radii; larger overlays may use 8-12 px.
+- Pills are reserved for statuses, compact toggles, and genuinely pill-shaped controls.
+- Use restrained 120-200 ms transitions and disable nonessential movement under reduced motion.
+- Use subtle borders and controlled shadows to establish hierarchy; avoid decorative gradients and floating decoration.
+
+## Layout
+
+- Keep navigation, chat, and work output as stable application regions.
+- Use `minmax(0, 1fr)` in flexible grid tracks so long content cannot force overflow.
+- Give chat and composer a shared readable measure and stable gutters.
+- Keep toolbars and icon controls dimensionally stable across hover, loading, and dynamic labels.