@geminilight/mindos 0.6.34 → 0.6.36

package/app/app/api/ask/route.ts

@@ -53,30 +53,67 @@ type MindOSSSEvent =
 
 // ---------------------------------------------------------------------------
 // Type Guards for AgentEvent variants (safe event handling)
+// AgentEvent from pi-coding-agent is a union; these interfaces describe the
+// actual shapes that arrive at runtime for each event.type.
 // ---------------------------------------------------------------------------
 
-function isTextDeltaEvent(e: AgentEvent): boolean {
-  return e.type === 'message_update' && (e as any).assistantMessageEvent?.type === 'text_delta';
+/** Fields present on message_update events (text_delta / thinking_delta). */
+type MessageUpdateEvent = AgentEvent & {
+  type: 'message_update';
+  assistantMessageEvent?: { type: string; delta?: string };
+};
+
+/** Fields present on tool_execution_start events. */
+type ToolExecStartEvent = AgentEvent & {
+  type: 'tool_execution_start';
+  toolCallId?: string;
+  toolName?: string;
+  args?: unknown;
+};
+
+/** Fields present on tool_execution_end events. */
+type ToolExecEndEvent = AgentEvent & {
+  type: 'tool_execution_end';
+  toolCallId?: string;
+  result?: { content?: Array<{ type: string; text?: string }> };
+  isError?: boolean;
+};
+
+/** Fields present on turn_end events. */
+type TurnEndEvent = AgentEvent & {
+  type: 'turn_end';
+  toolResults?: Array<{ toolName: string; content: unknown }>;
+  usage?: { inputTokens: number; outputTokens?: number };
+};
+
+/** Fields present on agent_end events. */
+type AgentEndEvent = AgentEvent & {
+  type: 'agent_end';
+  messages?: Array<{ role: string; content?: Array<{ type: string; text?: string }> }>;
+};
+
+function isTextDeltaEvent(e: AgentEvent): e is MessageUpdateEvent {
+  return e.type === 'message_update' && (e as MessageUpdateEvent).assistantMessageEvent?.type === 'text_delta';
 }
 
 function getTextDelta(e: AgentEvent): string {
-  return (e as any).assistantMessageEvent?.delta ?? '';
+  return (e as MessageUpdateEvent).assistantMessageEvent?.delta ?? '';
 }
 
-function isThinkingDeltaEvent(e: AgentEvent): boolean {
-  return e.type === 'message_update' && (e as any).assistantMessageEvent?.type === 'thinking_delta';
+function isThinkingDeltaEvent(e: AgentEvent): e is MessageUpdateEvent {
+  return e.type === 'message_update' && (e as MessageUpdateEvent).assistantMessageEvent?.type === 'thinking_delta';
 }
 
 function getThinkingDelta(e: AgentEvent): string {
-  return (e as any).assistantMessageEvent?.delta ?? '';
+  return (e as MessageUpdateEvent).assistantMessageEvent?.delta ?? '';
 }
 
-function isToolExecutionStartEvent(e: AgentEvent): boolean {
+function isToolExecutionStartEvent(e: AgentEvent): e is ToolExecStartEvent {
   return e.type === 'tool_execution_start';
 }
 
 function getToolExecutionStart(e: AgentEvent): { toolCallId: string; toolName: string; args: unknown } {
-  const evt = e as any;
+  const evt = e as ToolExecStartEvent;
   return {
     toolCallId: evt.toolCallId ?? '',
     toolName: evt.toolName ?? 'unknown',
@@ -84,15 +121,15 @@ function getToolExecutionStart(e: AgentEvent): { toolCallId: string; toolName: s
   };
 }
 
-function isToolExecutionEndEvent(e: AgentEvent): boolean {
+function isToolExecutionEndEvent(e: AgentEvent): e is ToolExecEndEvent {
   return e.type === 'tool_execution_end';
 }
 
 function getToolExecutionEnd(e: AgentEvent): { toolCallId: string; output: string; isError: boolean } {
-  const evt = e as any;
+  const evt = e as ToolExecEndEvent;
   const outputText = evt.result?.content
-    ?.filter((p: any) => p.type === 'text')
-    .map((p: any) => p.text)
+    ?.filter((p: { type: string; text?: string }) => p.type === 'text')
+    .map((p: { type: string; text?: string }) => p.text ?? '')
     .join('') ?? '';
   return {
     toolCallId: evt.toolCallId ?? '',
@@ -101,13 +138,13 @@ function getToolExecutionEnd(e: AgentEvent): { toolCallId: string; output: strin
   };
 }
 
-function isTurnEndEvent(e: AgentEvent): boolean {
+function isTurnEndEvent(e: AgentEvent): e is TurnEndEvent {
   return e.type === 'turn_end';
 }
 
 function getTurnEndData(e: AgentEvent): { toolResults: Array<{ toolName: string; content: unknown }> } {
   return {
-    toolResults: ((e as any).toolResults as any[]) ?? [],
+    toolResults: (e as TurnEndEvent).toolResults ?? [],
   };
 }
 
@@ -215,21 +252,21 @@ function textToolResult(text: string): AgentToolResult<Record<string, never>> {
 
 function getProtectedPaths(toolName: string, args: Record<string, unknown>): string[] {
   const pathsToCheck: string[] = [];
-  if (toolName === 'batch_create_files' && Array.isArray((args as any).files)) {
-    (args as any).files.forEach((f: any) => { if (f.path) pathsToCheck.push(f.path); });
+  if (toolName === 'batch_create_files' && Array.isArray(args.files)) {
+    (args.files as Array<{ path?: string }>).forEach((f) => { if (f.path) pathsToCheck.push(f.path); });
   } else {
-    const singlePath = (args as any).path ?? (args as any).from_path;
+    const singlePath = (args.path ?? args.from_path) as string | undefined;
     if (typeof singlePath === 'string') pathsToCheck.push(singlePath);
   }
   return pathsToCheck;
 }
 
-function toPiCustomToolDefinitions(tools: AgentTool<any>[]): ToolDefinition[] {
+function toPiCustomToolDefinitions(tools: AgentTool<any>[]): ToolDefinition<any, unknown>[] {
   return tools.map((tool) => ({
     name: tool.name,
     label: tool.label,
     description: tool.description,
-    parameters: tool.parameters as any,
+    parameters: tool.parameters as Record<string, unknown>,
     execute: async (toolCallId, params, signal, onUpdate) => {
       const args = (params ?? {}) as Record<string, unknown>;
 
@@ -414,7 +451,18 @@ export async function POST(req: NextRequest) {
     }
     if (bootstrap.instruction.ok) initContextBlocks.push(`## bootstrap_instruction\n\n${bootstrap.instruction.content}`);
     if (bootstrap.index?.ok) initContextBlocks.push(`## bootstrap_index\n\n${bootstrap.index.content}`);
-    if (bootstrap.config_json.ok) initContextBlocks.push(`## bootstrap_config_json\n\n${bootstrap.config_json.content}`);
+    if (bootstrap.config_json.ok) {
+      // Strip UI-only sections (uiSchema, keySpecs) — they are consumed exclusively
+      // by the frontend renderer and add ~1,120 tokens of noise the agent never uses.
+      let configContent = bootstrap.config_json.content;
+      try {
+        const parsed = JSON.parse(configContent);
+        delete parsed.uiSchema;
+        delete parsed.keySpecs;
+        configContent = JSON.stringify(parsed, null, 2);
+      } catch { /* keep original if parse fails */ }
+      initContextBlocks.push(`## bootstrap_config_json\n\n${configContent}`);
+    }
     if (bootstrap.config_md?.ok) initContextBlocks.push(`## bootstrap_config_md\n\n${bootstrap.config_md.content}`);
     if (bootstrap.target_readme?.ok) initContextBlocks.push(`## bootstrap_target_readme\n\n${bootstrap.target_readme.content}`);
     if (bootstrap.target_instruction?.ok) initContextBlocks.push(`## bootstrap_target_instruction\n\n${bootstrap.target_instruction.content}`);
@@ -455,7 +503,11 @@ export async function POST(req: NextRequest) {
 
     const promptParts: string[] = [AGENT_SYSTEM_PROMPT];
     promptParts.push(`---\n\n${timeContext}`);
-    promptParts.push(`---\n\nInitialization status (auto-loaded at request start):\n\n${initStatus}`);
+    // Only inject initStatus when there are failures or truncation warnings.
+    // On the happy path (~99% of requests) this saves ~100 tokens.
+    if (initFailures.length > 0 || truncationWarnings.length > 0) {
+      promptParts.push(`---\n\nInitialization status (auto-loaded at request start):\n\n${initStatus}`);
+    }
 
     if (initContextBlocks.length > 0) {
       promptParts.push(`---\n\nInitialization context:\n\n${initContextBlocks.join('\n\n---\n\n')}`);
@@ -604,7 +656,7 @@ export async function POST(req: NextRequest) {
             stepCount++;
 
             // Record token usage if available from the turn
-            const turnUsage = (event as any).usage;
+            const turnUsage = (event as TurnEndEvent).usage;
             if (turnUsage && typeof turnUsage.inputTokens === 'number') {
               metrics.recordTokens(turnUsage.inputTokens, turnUsage.outputTokens ?? 0);
             }
@@ -633,12 +685,13 @@ export async function POST(req: NextRequest) {
               void session.abort();
             }
 
-            console.log(`[ask] Step ${stepCount}/${stepLimit}`);
+            // Step count logged in dev only to avoid polluting production output
+            if (process.env.NODE_ENV === 'development') console.log(`[ask] Step ${stepCount}/${stepLimit}`);
           } else if (event.type === 'agent_end') {
             // Capture model errors from the last assistant message.
             // pi-coding-agent resolves prompt() without throwing after retries;
             // the error is only visible in agent_end event messages.
-            const msgs = (event as any).messages;
+            const msgs = (event as AgentEndEvent).messages;
             if (Array.isArray(msgs)) {
               for (let i = msgs.length - 1; i >= 0; i--) {
                 const m = msgs[i];

package/app/app/api/bootstrap/route.ts

@@ -25,6 +25,10 @@ export async function GET(req: NextRequest) {
     };
 
     if (targetDir) {
+      // Reject path traversal attempts
+      if (targetDir.includes('..') || path.isAbsolute(targetDir)) {
+        return NextResponse.json({ error: 'invalid target_dir' }, { status: 400 });
+      }
       result.target_readme = tryRead(path.join(targetDir, 'README.md'));
       result.target_instruction = tryRead(path.join(targetDir, 'INSTRUCTION.md'));
       result.target_config_json = tryRead(path.join(targetDir, 'CONFIG.json'));

package/app/app/api/export/route.ts

@@ -10,11 +10,16 @@ export async function GET(req: NextRequest) {
   const { searchParams } = req.nextUrl;
   const filePath = searchParams.get('path');
   const format = searchParams.get('format') ?? 'md';
+  const VALID_FORMATS = new Set(['md', 'html', 'zip', 'zip-html']);
 
   if (!filePath) {
     return NextResponse.json({ error: 'Missing path parameter' }, { status: 400 });
   }
 
+  if (!VALID_FORMATS.has(format)) {
+    return NextResponse.json({ error: `Invalid format: ${format}. Use: ${[...VALID_FORMATS].join(', ')}` }, { status: 400 });
+  }
+
   // Path traversal defense-in-depth
   if (filePath.includes('..') || filePath.startsWith('/')) {
     return NextResponse.json({ error: 'Invalid path' }, { status: 400 });

package/app/app/api/git/route.ts

@@ -19,7 +19,8 @@ export async function GET(req: NextRequest) {
       case 'history': {
         const filePath = req.nextUrl.searchParams.get('path');
         if (!filePath) return err('missing path');
-        const limit = parseInt(req.nextUrl.searchParams.get('limit') ?? '10', 10);
+        const rawLimit = parseInt(req.nextUrl.searchParams.get('limit') ?? '10', 10);
+        const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 100)) : 10;
         const entries = gitLog(filePath, limit);
         return NextResponse.json({ entries });
       }

package/app/app/api/recent-files/route.ts

@@ -4,7 +4,8 @@ import { getRecentlyModified } from '@/lib/fs';
 
 export async function GET(req: NextRequest) {
   const limitParam = req.nextUrl.searchParams.get('limit');
-  const limit = limitParam ? parseInt(limitParam, 10) : 10;
-  const files = getRecentlyModified(Math.min(limit, 30));
+  const raw = limitParam ? parseInt(limitParam, 10) : 10;
+  const limit = Number.isFinite(raw) ? raw : 10;
+  const files = getRecentlyModified(Math.max(1, Math.min(limit, 30)));
   return NextResponse.json(files);
 }

package/app/app/api/setup/route.ts

@@ -125,6 +125,7 @@ export async function POST(req: NextRequest) {
       webPassword: webPassword ?? '',
       startMode: current.startMode,
       setupPending: false,  // clear the flag
+      setupPort: undefined, // clear temporary setup port (zombie cleanup)
       disabledSkills,
       guideState: {
         active: true,

package/app/components/SyncStatusBar.tsx

@@ -183,7 +183,7 @@ export default function SyncStatusBar({ collapsed, onOpenSyncSettings }: SyncSta
     const currentLevel = getStatusLevel(status, false);
     const prev = prevLevelRef.current;
     if (prev !== currentLevel) {
-      const syncT = (t as any).sidebar?.sync;
+      const syncT = t.sidebar?.sync;
       // Recovery: was error/conflicts, now synced
       if ((prev === 'error' || prev === 'conflicts') && currentLevel === 'synced') {
         setToast(syncT?.syncRestored ?? 'Sync restored');

package/app/components/TableOfContents.tsx

@@ -14,7 +14,14 @@ function parseHeadings(content: string): Heading[] {
   const slugger = new GithubSlugger();
   const lines = content.split('\n');
   const headings: Heading[] = [];
+  let inCodeBlock = false;
   for (const line of lines) {
+    // Toggle code fence state (``` or ~~~, with optional language tag)
+    if (/^(`{3,}|~{3,})/.test(line)) {
+      inCodeBlock = !inCodeBlock;
+      continue;
+    }
+    if (inCodeBlock) continue;
     const match = line.match(/^(#{1,4})\s+(.+)/);
     if (match) {
       const level = match[1].length;

package/app/components/setup/StepAI.tsx

@@ -1,16 +1,35 @@
 'use client';
 
-import { Brain, Zap, SkipForward, CheckCircle2 } from 'lucide-react';
+import { useState, useEffect } from 'react';
+import { Brain, Zap, SkipForward, CheckCircle2, ChevronDown, ChevronRight, Copy } from 'lucide-react';
 import { Field, Input, ApiKeyInput } from '@/components/settings/Primitives';
-import type { SetupState, SetupMessages } from './types';
+import type { SetupState, SetupMessages, PortStatus } from './types';
+import StepPorts from './StepPorts';
 
 export interface StepAIProps {
   state: SetupState;
   update: <K extends keyof SetupState>(key: K, val: SetupState[K]) => void;
   s: SetupMessages;
+  onCopyToken: () => void;
+  // Port props (embedded in Advanced section)
+  webPortStatus: PortStatus;
+  mcpPortStatus: PortStatus;
+  setWebPortStatus: (s: PortStatus) => void;
+  setMcpPortStatus: (s: PortStatus) => void;
+  checkPort: (port: number, which: 'web' | 'mcp') => void;
+  portConflict: boolean;
 }
 
-export default function StepAI({ state, update, s }: StepAIProps) {
+export default function StepAI({ state, update, s, onCopyToken, webPortStatus, mcpPortStatus, setWebPortStatus, setMcpPortStatus, checkPort, portConflict }: StepAIProps) {
+  const [portsOpen, setPortsOpen] = useState(false);
+
+  // Auto-expand Advanced section if port check finds a problem
+  useEffect(() => {
+    if (!portsOpen && (webPortStatus.available === false || mcpPortStatus.available === false || portConflict)) {
+      setPortsOpen(true);
+    }
+  }, [webPortStatus.available, mcpPortStatus.available, portConflict, portsOpen]);
+
   const providers = [
     { id: 'anthropic' as const, icon: <Brain size={18} />, label: 'Anthropic', desc: 'Claude — claude-sonnet-4-6' },
     { id: 'openai' as const, icon: <Zap size={18} />, label: 'OpenAI', desc: 'GPT or any OpenAI-compatible API' },
@@ -70,6 +89,50 @@ export default function StepAI({ state, update, s }: StepAIProps) {
           )}
         </div>
       )}
+
+      {/* Advanced: Port Settings (collapsed) */}
+      <div className="pt-3 mt-1" style={{ borderTop: '1px solid var(--border)' }}>
+        <button
+          type="button"
+          onClick={() => setPortsOpen(!portsOpen)}
+          className="flex items-center gap-1.5 text-xs font-medium"
+          style={{ color: 'var(--muted-foreground)' }}>
+          {portsOpen ? <ChevronDown size={12} /> : <ChevronRight size={12} />}
+          {s.advancedPorts}
+        </button>
+        {portsOpen && (
+          <div className="mt-3 space-y-5">
+            {/* MCP Auth Token (read-only) */}
+            <div className="space-y-1.5">
+              <p className="text-xs font-medium" style={{ color: 'var(--foreground)' }}>
+                🔑 {s.tokenSectionTitle}
+              </p>
+              <div className="flex items-center gap-2">
+                <code className="flex-1 truncate text-xs font-mono px-3 py-2 rounded-lg"
+                  style={{ background: 'var(--muted)', color: 'var(--foreground)' }}>
+                  {state.authToken}
+                </code>
+                <button type="button" onClick={onCopyToken}
+                  className="flex items-center gap-1 px-2.5 py-2 text-xs rounded-lg border transition-colors hover:bg-muted shrink-0"
+                  style={{ borderColor: 'var(--border)', color: 'var(--foreground)' }}>
+                  <Copy size={12} /> {s.copyToken}
+                </button>
+              </div>
+              <p className="text-xs" style={{ color: 'var(--muted-foreground)' }}>
+                {s.tokenSectionHint}
+              </p>
+            </div>
+
+            {/* Port Settings */}
+            <StepPorts
+              state={state} update={update}
+              webPortStatus={webPortStatus} mcpPortStatus={mcpPortStatus}
+              setWebPortStatus={setWebPortStatus} setMcpPortStatus={setMcpPortStatus}
+              checkPort={checkPort} portConflict={portConflict} s={s}
+            />
+          </div>
+        )}
+      </div>
     </div>
   );
 }

package/app/components/setup/StepDots.tsx

@@ -1,5 +1,6 @@
 'use client';
 
+import { CheckCircle2 } from 'lucide-react';
 import { useLocale } from '@/lib/LocaleContext';
 
 export interface StepDotsProps {
@@ -7,32 +8,39 @@ export interface StepDotsProps {
   setStep: (s: number) => void;
   stepTitles: readonly string[];
   disabled?: boolean;
+  /** Number of "numbered" steps to show (Confirm step is not numbered) */
+  numberedSteps?: number;
 }
 
-export default function StepDots({ step, setStep, stepTitles, disabled }: StepDotsProps) {
+export default function StepDots({ step, setStep, stepTitles, disabled, numberedSteps }: StepDotsProps) {
   const { t } = useLocale();
+  const count = numberedSteps ?? stepTitles.length;
+  // Only render dots for numbered steps (exclude Confirm)
+  const dotsToShow = stepTitles.slice(0, count);
+  const isConfirmStep = step >= count;
+
   return (
     <div className="flex items-center gap-2 mb-8" role="navigation" aria-label="Setup steps">
-      {stepTitles.map((title: string, i: number) => (
+      {dotsToShow.map((title: string, i: number) => (
         <div key={i} className="flex items-center gap-2">
-          {i > 0 && <div className="w-8 h-px" style={{ background: i <= step ? 'var(--amber)' : 'var(--border)' }} />}
+          {i > 0 && <div className="w-8 h-px" style={{ background: i <= step || isConfirmStep ? 'var(--amber)' : 'var(--border)' }} />}
           <button onClick={() => setStep(i)}
             aria-current={i === step ? 'step' : undefined}
             aria-label={title}
             className="flex flex-col items-center gap-1 p-1 -m-1 disabled:cursor-not-allowed disabled:opacity-60"
-            disabled={disabled || i >= step}
-            title={(disabled || i >= step) ? t.hints.cannotJumpForward : undefined}>
+            disabled={disabled || i > step}
+            title={(disabled || i > step) ? t.hints.cannotJumpForward : undefined}>
             <div
               className="w-6 h-6 rounded-full text-xs font-medium flex items-center justify-center transition-colors"
               style={{
-                background: i <= step ? 'var(--amber)' : 'var(--muted)',
-                color: i <= step ? 'var(--amber-foreground)' : 'var(--muted-foreground)',
-                opacity: i <= step ? 1 : 0.5,
+                background: (i < step || isConfirmStep) ? 'var(--amber)' : i === step ? 'var(--amber)' : 'var(--muted)',
+                color: (i <= step || isConfirmStep) ? 'var(--amber-foreground)' : 'var(--muted-foreground)',
+                opacity: (i <= step || isConfirmStep) ? 1 : 0.5,
               }}>
-              {i + 1}
+              {(i < step || isConfirmStep) ? <CheckCircle2 size={14} /> : i + 1}
             </div>
             <span className="text-[10px] leading-tight hidden sm:inline max-w-[4rem] text-center truncate"
-              style={{ color: i === step ? 'var(--foreground)' : 'var(--muted-foreground)', opacity: i <= step ? 1 : 0.5 }}>
+              style={{ color: (i === step && !isConfirmStep) ? 'var(--foreground)' : 'var(--muted-foreground)', opacity: (i <= step || isConfirmStep) ? 1 : 0.5 }}>
               {title}
             </span>
           </button>

package/app/components/setup/StepKB.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import { useState, useEffect, useRef } from 'react';
+import { AlertCircle } from 'lucide-react';
 import { Field } from '@/components/settings/Primitives';
 import type { Messages } from '@/lib/i18n';
 import type { SetupState } from './types';
@@ -26,6 +27,7 @@ export interface StepKBProps {
 
 export default function StepKB({ state, update, t, homeDir }: StepKBProps) {
   const s = t.setup;
+  const [passwordTouched, setPasswordTouched] = useState(false);
   // Build platform-aware placeholder, e.g. /Users/alice/MindOS/mind or C:\Users\alice\MindOS\mind
   // Windows homedir always contains \, e.g. C:\Users\Alice — safe to detect by separator
   const sep = homeDir.includes('\\') ? '\\' : '/';
@@ -232,6 +234,30 @@ export default function StepKB({ state, update, t, homeDir }: StepKBProps) {
         </div>
       </div>
       )}
+
+      {/* ── Security ── */}
+      <div className="pt-2 mt-2" style={{ borderTop: '1px solid var(--border)' }}>
+        <Field label={<>{s.webPassword} <span style={{ color: 'var(--error)' }}>*</span></>} hint={s.webPasswordHint}>
+          <input
+            type="password"
+            value={state.webPassword}
+            onChange={e => { update('webPassword', e.target.value); setPasswordTouched(true); }}
+            onBlur={() => setPasswordTouched(true)}
+            placeholder="••••••••"
+            className="w-full px-3 py-2 text-sm rounded-lg border outline-none transition-colors focus-visible:ring-1 focus-visible:ring-ring"
+            style={{
+              background: 'var(--input, var(--card))',
+              borderColor: passwordTouched && !state.webPassword.trim() ? 'var(--error)' : 'var(--border)',
+              color: 'var(--foreground)',
+            }}
+          />
+          {passwordTouched && !state.webPassword.trim() && (
+            <p className="text-xs flex items-center gap-1 mt-1" style={{ color: 'var(--error)' }}>
+              <AlertCircle size={11} /> {s.webPasswordRequired}
+            </p>
+          )}
+        </Field>
+      </div>
     </div>
   );
 }

package/app/components/setup/constants.tsx

@@ -7,7 +7,8 @@ export const TEMPLATES: Array<{ id: Template; icon: React.ReactNode; dirs: strin
   { id: 'empty', icon: <FileText size={18} />, dirs: ['README.md', 'CONFIG.json', 'INSTRUCTION.md'] },
 ];
 
-export const TOTAL_STEPS = 6;
+export const TOTAL_STEPS = 4;
 export const STEP_KB = 0;
-export const STEP_PORTS = 2;
-export const STEP_AGENTS = 4;
+export const STEP_AI = 1;
+export const STEP_AGENTS = 2;
+export const STEP_REVIEW = 3;

package/app/components/setup/index.tsx

@@ -6,11 +6,9 @@ import { useLocale } from '@/lib/LocaleContext';
 import { copyToClipboard } from '@/lib/clipboard';
 import { toast } from '@/lib/toast';
 import type { SetupState, PortStatus, AgentEntry, AgentInstallStatus } from './types';
-import { TOTAL_STEPS, STEP_KB, STEP_PORTS, STEP_AGENTS } from './constants';
+import { TOTAL_STEPS, STEP_KB, STEP_AI, STEP_AGENTS, STEP_REVIEW } from './constants';
 import StepKB from './StepKB';
 import StepAI from './StepAI';
-import StepPorts from './StepPorts';
-import StepSecurity from './StepSecurity';
 import StepAgents from './StepAgents';
 import StepReview from './StepReview';
 import { RestartButton } from './StepReview';
@@ -122,8 +120,8 @@ export default function SetupWizard() {
     openaiModel: 'gpt-5.4',
     openaiBaseUrl: '',
     openaiKeyMask: '',
-    webPort: 3000,
-    mcpPort: 8787,
+    webPort: 3456,
+    mcpPort: 8781,
     authToken: '',
     webPassword: '',
   });
@@ -184,16 +182,16 @@ export default function SetupWizard() {
       });
   }, []);
 
-  // Auto-check ports when entering Step 3
+  // Auto-check ports when entering AI step (ports are in Advanced section)
   useEffect(() => {
-    if (step === STEP_PORTS) {
+    if (step === STEP_AI) {
       checkPort(state.webPort, 'web');
       checkPort(state.mcpPort, 'mcp');
     }
   // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [step]);
 
-  // Load agents when entering Step 5
+  // Load agents when entering Agents step
   useEffect(() => {
     if (step === STEP_AGENTS && !agentsLoaded && !agentsLoading) {
       setAgentsLoading(true);
@@ -256,15 +254,17 @@ export default function SetupWizard() {
   const portConflict = state.webPort === state.mcpPort;
 
   const canNext = () => {
-    if (step === STEP_KB) return state.mindRoot.trim().length > 0;
-    if (step === STEP_PORTS) {
+    if (step === STEP_KB) {
+      // KB path required + password required
+      return state.mindRoot.trim().length > 0 && state.webPassword.trim().length > 0;
+    }
+    if (step === STEP_AI) {
+      // Ports validation (only when Advanced is open and ports were modified)
       if (portConflict) return false;
       if (webPortStatus.checking || mcpPortStatus.checking) return false;
-      if (webPortStatus.available !== true || mcpPortStatus.available !== true) return false;
-      return (
-        state.webPort >= 1024 && state.webPort <= 65535 &&
-        state.mcpPort >= 1024 && state.mcpPort <= 65535
-      );
+      // Allow next if ports haven't been checked yet (user didn't open Advanced)
+      if (webPortStatus.available === false || mcpPortStatus.available === false) return false;
+      return true;
     }
     return true;
   };
@@ -359,32 +359,22 @@ export default function SetupWizard() {
         </div>
 
         <div className="flex justify-center">
-          <StepDots step={step} setStep={setStep} stepTitles={s.stepTitles} disabled={submitting || completed} />
+          <StepDots step={step} setStep={setStep} stepTitles={s.stepTitles} disabled={submitting || completed} numberedSteps={STEP_REVIEW} />
         </div>
 
         <h2 className="text-lg font-semibold mb-5" style={{ color: 'var(--foreground)' }}>
-          {s.stepTitles[step]}
+          {step === STEP_REVIEW ? `✓ ${s.stepTitles[step]}` : s.stepTitles[step]}
         </h2>
 
         {step === 0 && <StepKB state={state} update={update} t={t} homeDir={homeDir} />}
-        {step === 1 && <StepAI state={state} update={update} s={s} />}
-        {step === 2 && (
-          <StepPorts
-            state={state} update={update}
+        {step === 1 && (
+          <StepAI state={state} update={update} s={s} onCopyToken={copyToken}
             webPortStatus={webPortStatus} mcpPortStatus={mcpPortStatus}
             setWebPortStatus={setWebPortStatus} setMcpPortStatus={setMcpPortStatus}
-            checkPort={checkPort} portConflict={portConflict} s={s}
-          />
-        )}
-        {step === 3 && (
-          <StepSecurity
-            authToken={state.authToken}
-            onCopy={copyToken} onGenerate={generateToken}
-            webPassword={state.webPassword} onPasswordChange={v => update('webPassword', v)}
-            s={s}
+            checkPort={checkPort} portConflict={portConflict}
           />
         )}
-        {step === 4 && (
+        {step === 2 && (
           <StepAgents
             agents={agents} agentsLoading={agentsLoading}
             selectedAgents={selectedAgents} setSelectedAgents={setSelectedAgents}
@@ -394,7 +384,7 @@ export default function SetupWizard() {
             template={state.template}
           />
         )}
-        {step === 5 && (
+        {step === 3 && (
           <StepReview
             state={state} selectedAgents={selectedAgents}
             agentStatuses={agentStatuses} onRetryAgent={retryAgent}

package/app/data/skills/mindos/SKILL.md

@@ -96,21 +96,12 @@ It covers: startup protocol, write tool selection, and step-by-step execution de
 | List top-level Mind Spaces | `mindos_list_spaces` | Full `mindos_list_files` when you only need zone names and README blurbs |
 | Find files | `mindos_search_notes` (2-4 parallel keyword variants) | Single-keyword search |
 | Read content | `mindos_read_file` or `mindos_read_lines` (for large files) | Reading entire large file when you need 10 lines |
-| Small text edit | `mindos_update_section` / `mindos_update_lines` / `mindos_insert_after_heading` | `mindos_write_file` for small changes |
-| Append to end | `mindos_append_to_file` | Rewriting entire file to add a line |
-| Full file replacement | `mindos_write_file` | Using this when a section edit suffices |
-| New file | `mindos_create_file` | Creates parent dirs but does NOT scaffold Space files |
-| New Mind Space (zone + README + INSTRUCTION) | `mindos_create_space` | The only way to create a Space. `create_file` creates plain folders |
-| Rename a Space directory | `mindos_rename_space` | `rename_file` (files only; does not rename folders) |
-| Add CSV row | `mindos_append_csv` (validates header) | Manual string append without header check |
-| Check impact before rename | `mindos_get_backlinks` | Renaming without checking references |
-| Inspect recent changes | `mindos_get_recent` | Guessing what changed recently |
-| Recover old version | `mindos_get_file_at_version` | Asking user to recall what was there |
+
+Write, structural, and history tools → [references/write-supplement.md](./references/write-supplement.md).
 
 ### Fallbacks
 
 - `mindos_bootstrap` unavailable → manual reads of root `INSTRUCTION.md` + `README.md`.
-- Line/section tools unavailable → read + constrained `mindos_write_file` (simulate minimal edit).
 - Search returns empty → don't give up: (1) scan tree in context, (2) read candidate files directly, (3) `mindos_list_files` on specific subdirectories, (4) try synonym/alternate-language keywords.
 
 ---
@@ -120,17 +111,8 @@ It covers: startup protocol, write tool selection, and step-by-step execution de
 | Pattern | When | Key steps |
 |---------|------|-----------|
 | **Read-only Q&A** | Lookup / summarize / quote | Tree reasoning → search → read → answer with citations → state gaps |
-| **Single-file edit** | One clear target file | Startup → read target + local conventions → minimal edit → verify → summarize |
-| **Multi-file routing** | Unstructured input, multiple destinations | Parse into semantic units → routing table → confirm → edit → summarize |
-| **Conversation retrospective** | Distill / capture session | Confirm scope → extract decisions/pitfalls/actions → route → trace changes |
-| **SOP execution** | Repeatable procedure | Read SOP fully → execute stepwise → update stale sections → propose SOP update if diverged |
-| **Structural change** | Rename / move / delete | `get_backlinks` → impact report → confirm → execute → update refs → sync READMEs |
-| **CSV append** | Add row to a table | Read header → validate fields → `mindos_append_csv` |
-| **Cross-agent handoff** | Continue another agent's work | Read task state + decisions → continue without re-discovery → write back progress |
-| **Periodic review** | Summarize recent changes | `get_recent`/`get_history` → read changed files → structured summary |
-| **Handoff doc** | Create a briefing | Read sources → synthesize (background, decisions, status, open items) → place in project dir |
-
-For detailed execution steps on write patterns → [references/write-supplement.md](./references/write-supplement.md).
+
+For write, SOP, structural, and handoff patterns → [references/write-supplement.md](./references/write-supplement.md).
 
 ---