@miphamai/cli 0.16.0 → 0.16.2

package/src/ui/commands.ts

@@ -11,6 +11,18 @@ import type { PluginManager } from '../plugin/plugin-manager'
 import { McpClient } from '../mcp/client'
 import { NPM_INSTALL_COMMAND, NPM_UPDATE_COMMAND, PACKAGE_VERSION } from '../shared/index.ts'
 import { getPreference } from '../config/preferences'
+import { stripIndent } from './strip-indent.js'
+import {
+  initCmd,
+  setupCmd,
+  recommendCmd,
+  permissionsCmd,
+  addDirCmd,
+  securityCmd,
+  promptAuditCmd,
+} from '../commands/project.js'
+import { themeCmd, releaseNotesCmd, ideCmd, terminalSetupCmd } from '../commands/environment.js'
+import { commitCmd, pushCmd, prCmd, issueCmd } from '../commands/git.js'
 
 export interface CommandContext {
   engine: QueryEngine
@@ -25,6 +37,7 @@ export interface CommandContext {
   setEffort: (level: string) => void
   setFocusMode: (on: boolean) => void
   setGoal: (text: string) => void
+  setUltracodeMode: (on: boolean) => void
   skillsLoader?: SkillsLoader
   pluginManager?: PluginManager
 }
@@ -47,7 +60,7 @@ export interface CommandResult {
   forwardToAI?: string
 }
 
-type CommandHandler = (
+export type CommandHandler = (
   ctx: CommandContext,
   args: string[],
 ) => CommandResult | Promise<CommandResult>
@@ -475,90 +488,6 @@ const todosCmd: CommandHandler = (_ctx, args) => {
 // Project
 // ═══════════════════════════════════════════════════════════════
 
-const initCmd: CommandHandler = async (ctx) => {
-  const { existsSync, mkdirSync, writeFileSync } = await import('node:fs')
-  const { join } = await import('node:path')
-  const { homedir } = await import('node:os')
-
-  const home = homedir()
-  const userConfigPath = join(home, '.mipham', 'config.yml')
-
-  // Generate user-friendly config if it doesn't exist yet
-  if (!existsSync(userConfigPath)) {
-    mkdirSync(join(home, '.mipham'), { recursive: true })
-
-    const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
-    const providerYaml = activeProviders
-      .map((p) => {
-        const tips: Record<string, string> = {
-          anthropic: '# Get key: https://console.anthropic.com/',
-          openai: '# Get key: https://platform.openai.com/api-keys',
-          deepseek: '# Get key: https://platform.deepseek.com/api_keys',
-          kimi: '# Get key: https://platform.moonshot.cn/',
-          doubao: '# Get key: https://console.volcengine.com/ark',
-          hunyuan: '# Get key: https://console.cloud.tencent.com/hunyuan',
-          qwen: '# Get key: https://dashscope.console.aliyun.com/apiKey',
-          google: '# Get key: https://aistudio.google.com/apikey',
-        }
-        const comment = tips[p.id] || ''
-        const baseUrlLine = p.baseUrl ? `\n    baseUrl: "${p.baseUrl}"` : ''
-        return `  ${comment}
-  - id: ${p.id}
-    name: "${p.name}"${baseUrlLine}
-    apiKey: "\${${p.id.toUpperCase()}_API_KEY}"`
-      })
-      .join('\n\n')
-
-    const configContent = `# Mipham Code — User Configuration
-# Location: ~/.mipham/config.yml
-# Docs:     https://mipham.ai/code/docs/config
-#
-# ═══ Quick Start ═══
-# 1. Replace the API key placeholders below with your real keys
-# 2. Save the file
-# 3. Run 'mipham' — it auto-detects configured providers
-#
-# ═══ Environment Variables (Alternative) ═══
-# Instead of editing this file, you can set env vars:
-#   export ANTHROPIC_API_KEY="sk-ant-..."
-#   export OPENAI_API_KEY="sk-..."
-#   (The \${VAR} syntax below reads from environment variables)
-
-# ── Defaults ──
-defaultProvider: ${ctx.providerId}
-defaultModel: ${ctx.modelId}
-permission: ask
-
-# ── Providers (${activeProviders.length} pre-configured — just add your API keys) ──
-providers:
-${providerYaml}
-`
-
-    writeFileSync(userConfigPath, configContent, 'utf-8')
-    return {
-      content: `✅ Mipham Code initialized!
-
-Created: ~/.mipham/config.yml (${activeProviders.length} providers pre-configured)
-
-Next steps:
-  1. Edit ~/.mipham/config.yml — replace API key placeholders with your real keys
-  2. Run mipham to start
-
-Providers configured:
-${activeProviders.map((p) => `  • ${p.name} — ${p.id.toUpperCase()}_API_KEY`).join('\n')}
-
-Tip: /setup for the full 6-step wizard.`,
-    }
-  }
-
-  // Config already exists — show status
-  return {
-    content: `~/.mipham/config.yml already exists.
-
-Run /setup for the full wizard, or /config to view current settings.`,
-  }
-}
-
 // ═══════════════════════════════════════════════════════════════
 // Phase 1 — New Session Commands
 // ═══════════════════════════════════════════════════════════════
@@ -1165,6 +1094,52 @@ const focusCmd: CommandHandler = (ctx) => {
   }
 }
 
+// ═══════════════════════════════════════════════════════════════
+// Ultracode Mode — toggle multi-agent workflow orchestration
+// ═══════════════════════════════════════════════════════════════
+
+const ultracodeCmd: CommandHandler = (ctx, args) => {
+  const arg = args[0]?.toLowerCase()
+  if (arg === 'on') {
+    ctx.setUltracodeMode(true)
+    return {
+      content:
+        '✓ Ultracode mode ON — multi-agent workflow orchestration enabled.\n\nThe AI will use Workflow tool to fan out, verify, and synthesize for all substantive tasks.',
+      forwardToAI: stripIndent`
+        Ultracode mode is now ACTIVE. For every substantive task:
+        - Use the Workflow tool to orchestrate multi-agent execution
+        - Default to pipeline() for multi-stage work — stages flow independently
+        - Fan out independent work across parallel agents
+        - Apply adversarial verification (verify with skeptics) to findings before accepting them
+        - Synthesize results with a top-tier model pass
+        - Prefer pipeline() over parallel() barriers — don't block stages unnecessarily
+        - Use loopUntilConvergence when discovering unknown-size sets (bugs, issues, edge cases)
+        - EDGE LOGIC IS FREE: flatten, dedupe, filter in plain JavaScript — NOT agent calls
+        Keep responses concise — the workflow graph handles the depth.`,
+    }
+  } else if (arg === 'off') {
+    ctx.setUltracodeMode(false)
+    return {
+      content: '✓ Ultracode mode OFF.',
+      forwardToAI:
+        'Ultracode mode is now OFF. Revert to standard single-agent execution. Do NOT use Workflow tool unless explicitly asked.',
+    }
+  }
+  return {
+    content: stripIndent`
+      Usage: /ultracode [on|off]
+
+      Ultracode mode enables multi-agent workflow orchestration for every substantive task.
+      When ON, the AI uses the Workflow tool to decompose tasks, fan out parallel agents,
+      verify findings adversarially, and synthesize results with a top-tier model.
+
+      Examples:
+        /ultracode on    — enable multi-agent mode
+        /ultracode off   — return to standard single-agent mode
+    `,
+  }
+}
+
 // ═══════════════════════════════════════════════════════════════
 // Phase 1 — Workflow Commands
 // ═══════════════════════════════════════════════════════════════
@@ -1541,145 +1516,6 @@ const doctorCmd: CommandHandler = async (ctx) => {
 // GitHub & Git Workflow Commands (Claude Code parity)
 // ═══════════════════════════════════════════════════════════════
 
-const commitCmd: CommandHandler = async () => {
-  try {
-    const { execSync } = await import('node:child_process')
-    const diff = execSync('git diff --cached --stat', { encoding: 'utf-8', timeout: 5000 }).trim()
-    const unstaged = execSync('git diff --name-only', { encoding: 'utf-8', timeout: 5000 }).trim()
-
-    if (!diff) {
-      let msg = '── Git Commit ──\n\nNo staged changes found.\n\n'
-      if (unstaged) {
-        msg +=
-          'Unstaged changes exist:\n' +
-          unstaged
-            .split('\n')
-            .map((f) => '  • ' + f)
-            .join('\n') +
-          '\n\n'
-      }
-      msg +=
-        'Run: git add <files> to stage changes first.\nOr type: "commit these changes" for AI assistance.'
-      return { content: msg }
-    }
-
-    return {
-      content: [
-        '── Git Commit ──',
-        '',
-        'Staged changes:',
-        diff,
-        '',
-        'To generate a commit message, type: "write a commit message for these changes"',
-        'To commit: git commit -m "your message"',
-        '',
-        'Tip: Use Conventional Commits format (feat:, fix:, chore:, docs:)',
-      ].join('\n'),
-    }
-  } catch {
-    return { content: '── Git Commit ──\n\nCould not run git. Are you in a git repository?' }
-  }
-}
-
-const pushCmd: CommandHandler = async () => {
-  try {
-    const { execSync } = await import('node:child_process')
-    const branch = execSync('git branch --show-current', {
-      encoding: 'utf-8',
-      timeout: 3000,
-    }).trim()
-    const ahead = execSync(`git rev-list --count origin/${branch}..HEAD 2>/dev/null || echo 0`, {
-      encoding: 'utf-8',
-      timeout: 3000,
-    }).trim()
-
-    return {
-      content: [
-        '── Git Push ──',
-        '',
-        `Branch: ${branch || '(unknown)'}`,
-        `Commits ahead of remote: ${ahead}`,
-        '',
-        ahead !== '0'
-          ? `Ready to push ${ahead} commit(s). Run: git push origin ${branch}`
-          : 'Nothing to push (up to date).',
-        '',
-        'Or type: "push my changes" for AI assistance.',
-      ].join('\n'),
-    }
-  } catch {
-    return { content: '── Git Push ──\n\nCould not determine git status.' }
-  }
-}
-
-const prCmd: CommandHandler = async () => {
-  try {
-    const { execSync } = await import('node:child_process')
-    const branch = execSync('git branch --show-current', {
-      encoding: 'utf-8',
-      timeout: 3000,
-    }).trim()
-    const mainBranch =
-      execSync('git remote show origin 2>/dev/null | grep "HEAD branch" | cut -d: -f2', {
-        encoding: 'utf-8',
-        timeout: 3000,
-      }).trim() || 'main'
-
-    const diff = execSync(
-      `git diff --stat origin/${mainBranch}...HEAD 2>/dev/null || git diff --stat ${mainBranch}...HEAD 2>/dev/null || echo ""`,
-      { encoding: 'utf-8', timeout: 5000 },
-    ).trim()
-
-    const commits = execSync(
-      `git log --oneline origin/${mainBranch}..HEAD 2>/dev/null || git log --oneline ${mainBranch}..HEAD 2>/dev/null || echo ""`,
-      { encoding: 'utf-8', timeout: 5000 },
-    ).trim()
-
-    return {
-      content: [
-        '── Create Pull Request ──',
-        '',
-        `Branch: ${branch} → ${mainBranch}`,
-        '',
-        commits
-          ? `Commits:\n${commits
-              .split('\n')
-              .map((c) => '  ' + c)
-              .join('\n')}`
-          : 'No commits ahead.',
-        '',
-        diff ? `Changes:\n${diff}` : '',
-        '',
-        'To create PR: type "create a pull request" for AI assistance.',
-        'Or use: gh pr create --base ' + mainBranch + ' --head ' + branch,
-      ].join('\n'),
-    }
-  } catch {
-    return { content: '── Create Pull Request ──\n\nCould not determine PR context.' }
-  }
-}
-
-const issueCmd: CommandHandler = async () => {
-  return {
-    content: [
-      '── GitHub Issues ──',
-      '',
-      'To file an issue, type: "create a GitHub issue for [description]"',
-      '',
-      'Quick commands:',
-      '  gh issue create --title "..." --body "..."',
-      '  gh issue list',
-      '',
-      'Use /github-ops skill for advanced GitHub automation.',
-    ].join('\n'),
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Code Quality — bridge slash commands to skills (Claude Code parity)
-// ═══════════════════════════════════════════════════════════════
-
-/** Factory for git-diff-based commands that bridge to AI skills via forwardToAI. */
 function gitDiffBridgeCmd(opts: {
   label: string
   noChangesHint: string
@@ -2500,1285 +2336,176 @@ const workflowAutoCmd: CommandHandler = async (_ctx, args) => {
 }
 
 // ═══════════════════════════════════════════════════════════════
-// Permissions
+// /deep-research <topic> — multi-agent deep research pipeline
 // ═══════════════════════════════════════════════════════════════
 
-const permissionsCmd: CommandHandler = (ctx) => {
-  const c = ctx.engine.getContext()
-  const msgs = c.getMessages()
+const deepResearchCmd: CommandHandler = (_ctx, args) => {
+  const topic = args.join(' ').trim()
+  if (!topic) {
+    return {
+      content: stripIndent`
+        Usage: /deep-research <topic>
 
+        Conducts multi-agent deep research — 5-angle parallel search, adversarial verification,
+        and top-tier synthesis into a well-cited report.
+
+        Example:
+          /deep-research impact of quantum computing on cryptography
+          /deep-research latest advances in CRISPR gene editing
+      `,
+    }
+  }
   return {
-    content: `─ Permission Settings ─
+    content: stripIndent`
+      ── Deep Research ──
+
+      Topic: "${topic}"
 
-Mode:       ${ctx.config.permission}
-Messages:   ${msgs.length} in context
-Tools:      ${ctx.engine.getTools().size} available
+      Orchestrating multi-agent research pipeline:
+        1. Scope — 5 research angles
+        2. Research — parallel web searches
+        3. Reduce — deduplicate + merge
+        4. Verify — adversarial skeptic pass
+        5. Synthesize — cited report, top model
 
-Permission levels:
-  auto    — run tools automatically without asking
-  ask     — prompt before each tool execution (default)
-  bypass  — skip all permission checks (use with caution)
+      This may take a few minutes...
+    `,
+    forwardToAI: stripIndent`
+      Conduct deep research on: "${topic}"
+
+      Use the Workflow tool to orchestrate a multi-agent research pipeline:
+
+      **Phase 1 — Scope**: Define 5 research angles covering: overview, technical-details,
+      competitors/alternatives, criticism/limitations, future-trends.
+
+      **Phase 2 — Research**: Fan out parallel web searches across all 5 angles. Each agent
+      searches the web and returns sources with titles, URLs, and key points. Use schema
+      validation to ensure structured output.
 
-Change with /config permission <level>.
+      **Phase 3 — Reduce**: Deduplicate sources by URL. Merge overlapping findings. EDGE LOGIC
+      IS FREE — use plain JavaScript, not agent calls.
 
-Current directory permissions:
-  CWD:      ${process.cwd()}
+      **Phase 4 — Verify**: Run adversarial verification (verify with mode: 'adversarial',
+      skeptics: 2, threshold: 1) on each key claim. Discard claims that fail verification.
 
-To add a directory: use /add-dir (coming soon).
-Tool execution is sandboxed to the project directory by default.`,
+      **Phase 5 — Synthesize**: Use the best available model to synthesize all verified findings
+      into a comprehensive, well-cited research report. Include:
+      - Executive summary
+      - Key findings with source citations (title, URL)
+      - Competing perspectives and disagreements
+      - Gaps and unknowns
+      - Recommendations for further reading
+
+      Output the final report as a structured markdown document with inline citations.
+    `,
   }
 }
 
+// ═══════════════════════════════════════════════════════════════
+// Permissions
+// ═══════════════════════════════════════════════════════════════
+
 // ═══════════════════════════════════════════════════════════════
 // Recommend — analyze project and recommend setup (like Claude Code
 // automation recommender)
 // ═══════════════════════════════════════════════════════════════
 
-const recommendCmd: CommandHandler = async (ctx) => {
-  const { existsSync, readFileSync } = await import('node:fs')
-  const { join } = await import('node:path')
-  const { getAvailableSkills } = await import('../skills/registry')
-
-  const cwd = process.cwd()
-  const lines: string[] = ['── Mipham Code: Setup Recommendations ──', '', `Project: ${cwd}`, '']
-
-  // ── Detect project type ──
-  const hasPackageJson = existsSync(join(cwd, 'package.json'))
-  const hasTsConfig = existsSync(join(cwd, 'tsconfig.json'))
-  const hasPyProject = existsSync(join(cwd, 'pyproject.toml'))
-  const hasRequirements = existsSync(join(cwd, 'requirements.txt'))
-  const hasDockerfile = existsSync(join(cwd, 'Dockerfile'))
-  const hasGitHubActions = existsSync(join(cwd, '.github', 'workflows'))
-  const hasNextConfig =
-    existsSync(join(cwd, 'next.config.js')) || existsSync(join(cwd, 'next.config.ts'))
-  const hasVueConfig =
-    existsSync(join(cwd, 'vite.config.ts')) || existsSync(join(cwd, 'vite.config.js'))
-  const hasTailwind =
-    existsSync(join(cwd, 'tailwind.config.ts')) || existsSync(join(cwd, 'tailwind.config.js'))
-
-  let pkgData: Record<string, unknown> = {}
-  if (hasPackageJson) {
-    try {
-      pkgData = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf-8'))
-    } catch {
-      /* ignore */
-    }
-  }
-  const deps = {
-    ...((pkgData.dependencies as Record<string, string>) || {}),
-    ...((pkgData.devDependencies as Record<string, string>) || {}),
-  }
-  const isTypeScript = hasTsConfig || 'typescript' in deps
-  const isReact = 'react' in deps || 'next' in deps
-  const isVue = 'vue' in deps
-  const isNode = hasPackageJson
-  const isPython = hasPyProject || hasRequirements
-  const isFastAPI = 'fastapi' in deps
-  const isNextJS = 'next' in deps
-  const isExpress = 'express' in deps || 'fastify' in deps
-  const isDocker = hasDockerfile
-
-  // ── Detection summary ──
-  const tags: string[] = []
-  if (isTypeScript) tags.push('TypeScript')
-  if (isReact) tags.push('React')
-  if (isVue) tags.push('Vue')
-  if (isNextJS) tags.push('Next.js')
-  if (isExpress) tags.push('Node.js API')
-  if (isFastAPI) tags.push('FastAPI')
-  if (isPython) tags.push('Python')
-  if (isDocker) tags.push('Docker')
-  if (hasTailwind) tags.push('Tailwind CSS')
-  if (hasGitHubActions) tags.push('CI/CD')
-
-  lines.push('── Detected Stack ──')
-  lines.push('')
-  if (tags.length > 0) {
-    lines.push(`  ${tags.join(' · ')}`)
-  } else {
-    lines.push('  (generic project — no specific framework detected)')
-  }
-  lines.push('')
-
-  // ── Skill recommendations ──
-  const communitySkills = getAvailableSkills()
-  const recommendedSkills: string[] = []
-
-  // Always useful
-  recommendedSkills.push('code-review')
-  recommendedSkills.push('systematic-debugging')
-
-  if (isTypeScript || isNode) {
-    recommendedSkills.push('github-ops')
-  }
-  if (isReact || isVue || isNextJS) {
-    recommendedSkills.push('frontend-design')
-  }
-  if (hasGitHubActions) {
-    recommendedSkills.push('security-review')
-  }
-  if (isPython) {
-    recommendedSkills.push('doc-generator')
-  }
+// ═══════════════════════════════════════════════════════════════
+// Setup — guided project initialization (mirrors Claude Code /setup)
+// ═══════════════════════════════════════════════════════════════
 
-  // Filter to only those in the registry
-  const available = recommendedSkills.filter((name) => communitySkills.some((s) => s.name === name))
+// ═══════════════════════════════════════════════════════════════
+// Theme — display theme toggle
+// ═══════════════════════════════════════════════════════════════
 
-  lines.push('── Recommended Skills ──')
-  lines.push('')
-  if (available.length > 0) {
-    for (const name of available) {
-      const entry = communitySkills.find((s) => s.name === name)!
-      lines.push(`  /install-skill ${name.padEnd(26)} ${entry.description}`)
-    }
-  }
-  lines.push('  /browse-skills           Browse all community skills')
-  lines.push('')
+const mcpCmd: CommandHandler = (ctx) => {
+  const configuredServers = ctx.config.skills?.mcpServers ?? []
+  const liveConnections = McpClient.getInstance().listConnections()
 
-  // ── Provider recommendations ──
-  const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
-  const configured = activeProviders.filter((p) => p.apiKey && p.apiKey.trim() !== '')
+  const lines: string[] = ['── MCP Servers ──', '']
 
-  lines.push('── Provider Status ──')
-  lines.push('')
-  if (configured.length === 0) {
-    lines.push('  ⚠ No providers have API keys configured.')
-    lines.push('  Run /setup 2 to configure providers.')
+  if (configuredServers.length > 0) {
+    lines.push(`Configured servers (${configuredServers.length}):`)
     lines.push('')
-    lines.push('  Recommended for this project:')
-    if (isTypeScript || isNode || isReact) {
-      lines.push('    • anthropic — Claude (code generation, review)')
-      lines.push('    • openai   — GPT-5 (general purpose)')
-    }
-    if (isPython) {
-      lines.push('    • anthropic — Claude (data science, ML)')
+    for (const s of configuredServers) {
+      const live = liveConnections.find((c) => c.config.name === s.name)
+      const statusIcon = live
+        ? live.status === 'connected'
+          ? '🟢'
+          : live.status === 'connecting'
+            ? '🟡'
+            : live.status === 'error'
+              ? '🔴'
+              : '⚪'
+        : '⚪'
+      const statusLabel = live ? live.status : 'not started'
+      const envKeys = s.env ? Object.keys(s.env).join(', ') : '(none)'
+
+      lines.push(`  ${statusIcon} ${s.name}  [${statusLabel}]`)
+      lines.push(`     Command: ${s.command} ${s.args.join(' ')}`)
+      lines.push(`     Env vars: ${envKeys}`)
+      if (live?.tools && live.tools.length > 0) {
+        lines.push(`     Tools: ${live.tools.map((t) => t.name).join(', ')}`)
+      }
+      if (live?.error) {
+        lines.push(`     Error: ${live.error}`)
+      }
+      if (live?.serverInfo) {
+        lines.push(`     Server: ${live.serverInfo.name} v${live.serverInfo.version}`)
+      }
+      lines.push('')
     }
   } else {
-    lines.push(`  ${configured.length}/${activeProviders.length} providers configured`)
-    for (const p of configured) {
-      lines.push(`    ✅ ${p.id.padEnd(14)} ${p.name}`)
-    }
+    lines.push('No MCP servers configured.')
+    lines.push('')
+    lines.push('── Configuration ──')
+    lines.push('')
+    lines.push('Add MCP servers to .mipham/config.yml:')
+    lines.push('')
+    lines.push('  skills:')
+    lines.push('    mcpServers:')
+    lines.push('      - name: filesystem')
+    lines.push('        command: npx')
+    lines.push('        args: ["-y", "@anthropic/mcp-filesystem", "/path"]')
+    lines.push('        env:')
+    lines.push('          HOME: $HOME')
+    lines.push('')
+    lines.push('      - name: github')
+    lines.push('        command: npx')
+    lines.push('        args: ["-y", "@anthropic/mcp-github"]')
+    lines.push('        env:')
+    lines.push('          GITHUB_TOKEN: $GITHUB_TOKEN')
+    lines.push('')
+    lines.push('After configuring, restart Mipham Code to connect.')
+    lines.push('Use the MCP tool (Tool 16) to call server tools.')
   }
-  lines.push('')
 
-  // ── Config recommendations ──
-  lines.push('── Configuration Tips ──')
   lines.push('')
-
-  const hasProjectMipham = existsSync(join(cwd, '.mipham'))
-  if (!hasProjectMipham) {
-    lines.push('  /setup 1     Initialize .mipham/ + MIPHAM.md + config.yml')
-  }
-
-  const { listInstalledSkills } = await import('../skills/registry')
-  const installed = listInstalledSkills()
-  if (installed.length === 0 && available.length > 0) {
-    lines.push('  Tip:         Install recommended skills above for better AI assistance')
-  }
-
-  if (isDocker && !hasProjectMipham) {
-    lines.push('  Tip:         Add .mipham/ to .dockerignore for smaller images')
-  }
-
-  if (hasGitHubActions) {
-    lines.push('  /setup 5     Configure tool permissions for CI/CD safety')
-  }
-
-  lines.push('  /setup       Full setup wizard (6 steps)')
-  lines.push('  /help        All commands')
+  lines.push('── Protocol ──')
+  lines.push('MCP stdio transport (JSON-RPC 2.0) — fully implemented.')
+  lines.push('Servers auto-connect on startup when configured.')
   lines.push('')
+  lines.push('Learn more: https://modelcontextprotocol.io')
 
   return { content: lines.join('\n') }
 }
 
 // ═══════════════════════════════════════════════════════════════
-// Setup — guided project initialization (mirrors Claude Code /setup)
+// Phase 4 — Login / API Key Management
 // ═══════════════════════════════════════════════════════════════
 
-const setupCmd: CommandHandler = async (ctx, args) => {
-  const step = args[0]
+const loginCmd: CommandHandler = (ctx) => {
+  const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
 
-  // ── Step selection ──
-  if (step === '1' || step === 'init') {
-    return setupStep1(ctx)
-  }
-  if (step === '2' || step === 'providers') {
-    return setupStep2(ctx)
-  }
-  if (step === '3' || step === 'model') {
-    return setupStep3(ctx)
-  }
-  if (step === '4' || step === 'skills') {
-    return setupStep4(ctx)
-  }
-  if (step === '5' || step === 'permissions') {
-    return setupStep5(ctx)
-  }
-  if (step === '6' || step === 'shell') {
-    return setupStep6(ctx)
-  }
-
-  // ── Check existing setup status ──
-  const { existsSync } = await import('node:fs')
-  const { join } = await import('node:path')
-  const cwd = process.cwd()
-  const home = process.env.HOME || '~'
-
-  const hasProjectMipham = existsSync(join(cwd, 'MIPHAM.md'))
-  const hasProjectConfig = existsSync(join(cwd, '.mipham', 'config.yml'))
-  const hasUserConfig = existsSync(join(home, '.mipham', 'config.yml'))
-  const hasMiphamDir = existsSync(join(cwd, '.mipham'))
-
-  const activeProviders = ctx.config.providers.filter((p) => p.status === 'active').length
-  const totalProviders = ctx.config.providers.length
-  const skills = ctx.skillsLoader?.list() || []
-  const standardSkills = skills.filter((s: { type: string }) => s.type === 'standard').length
-  const miphamSkills = skills.filter((s: { type: string }) => s.type === 'mipham').length
-
-  const statusIcon = (ok: boolean) => (ok ? '✅' : '⬜')
-
-  return {
-    content: `── Mipham Code Setup ──
-
-
-  Project Status
-  ${statusIcon(hasMiphamDir)} .mipham/ directory  ${hasMiphamDir ? '(config + metadata)' : '(not created)'}
-  ${statusIcon(hasProjectMipham)} MIPHAM.md           ${hasProjectMipham ? '(project personality)' : '(not created)'}
-  ${statusIcon(hasProjectConfig)} Project config       ${hasProjectConfig ? '~/.mipham/config.yml' : '(not created)'}
-  ${statusIcon(hasUserConfig)} User config          ${hasUserConfig ? '~/.mipham/config.yml' : '(not created)'}
-
-  Providers
-  ${activeProviders}/${totalProviders} active  ·  Current: ${ctx.providerId}/${ctx.modelId}
-
-  Skills
-  ${skills.length} loaded (${standardSkills} standard + ${miphamSkills} mipham)
-
-  Permissions
-  Mode: ${ctx.config.permission}  ·  Tools: ${ctx.engine.getTools().size}
-
-
-  ── Setup Steps ──
-
-  1. Initialize Project    /setup 1   Create .mipham/ + MIPHAM.md + config.yml
-  2. Configure Providers   /setup 2   Set API keys, enable/disable providers
-  3. Set Default Model     /setup 3   Choose your preferred provider & model
-  4. Install Skills        /setup 4   Browse and install community skills
-  5. Permissions Setup     /setup 5   Configure tool access and security
-  6. Shell Integration     /setup 6   Add \`mipham\` to PATH, IDE setup
-
-  Run: /setup <number>    or chat: "help me set up Mipham Code"`,
-  }
-}
-
-async function setupStep1(ctx: CommandContext): Promise<CommandResult> {
-  const { existsSync, mkdirSync, writeFileSync } = await import('node:fs')
-  const { join } = await import('node:path')
-  const cwd = process.cwd()
-
-  const miphamDir = join(cwd, '.mipham')
-  const miphamPath = join(cwd, 'MIPHAM.md')
-  const configPath = join(miphamDir, 'config.yml')
-
-  const created: string[] = []
-  const skipped: string[] = []
-
-  // Create .mipham/ directory
-  if (!existsSync(miphamDir)) {
-    mkdirSync(miphamDir, { recursive: true })
-    created.push('.mipham/')
-  } else {
-    skipped.push('.mipham/ (already exists)')
-  }
-
-  // Create project config if missing
-  if (!existsSync(configPath)) {
-    // Generate a user-friendly config with all providers pre-populated.
-    // Users just need to replace the API key placeholders with their real keys.
-    const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
-    const providerYaml = activeProviders
-      .map((p) => {
-        const comment =
-          p.id === 'anthropic'
-            ? '# Get key: https://console.anthropic.com/'
-            : p.id === 'openai'
-              ? '# Get key: https://platform.openai.com/api-keys'
-              : p.id === 'deepseek'
-                ? '# Get key: https://platform.deepseek.com/api_keys'
-                : p.id === 'kimi'
-                  ? '# Get key: https://platform.moonshot.cn/'
-                  : p.id === 'doubao'
-                    ? '# Get key: https://console.volcengine.com/ark'
-                    : p.id === 'hunyuan'
-                      ? '# Get key: https://console.cloud.tencent.com/hunyuan'
-                      : p.id === 'qwen'
-                        ? '# Get key: https://dashscope.console.aliyun.com/apiKey'
-                        : p.id === 'google'
-                          ? '# Get key: https://aistudio.google.com/apikey'
-                          : ''
-        const baseUrlLine = p.baseUrl ? `\n    baseUrl: "${p.baseUrl}"` : ''
-        return `  ${comment}
-  - id: ${p.id}
-    name: "${p.name}"${baseUrlLine}
-    apiKey: "\${${p.id.toUpperCase()}_API_KEY}"`
-      })
-      .join('\n\n')
-
-    const defaultConfig = `# Mipham Code — User Configuration
-# Location: ~/.mipham/config.yml
-# Docs:     https://mipham.ai/code/docs/config
-#
-# ═══ Quick Start ═══
-# 1. Set your API keys below (replace the placeholder values)
-# 2. Save the file
-# 3. Run 'mipham' — it auto-detects configured providers
-#
-# ═══ Environment Variables ═══
-# Instead of editing this file, you can set env vars:
-#   export ANTHROPIC_API_KEY="sk-ant-..."
-#   export OPENAI_API_KEY="sk-..."
-#   (The \${VAR} syntax below reads from environment variables)
-
-# ── Defaults ──
-defaultProvider: ${ctx.providerId}
-defaultModel: ${ctx.modelId}
-permission: ask
-
-# ── Providers (8 configured, just add your API keys) ──
-providers:
-${providerYaml}
-`
-    writeFileSync(configPath, defaultConfig, 'utf-8')
-    created.push('.mipham/config.yml')
-  } else {
-    skipped.push('.mipham/config.yml (already exists)')
-  }
-
-  // Create MIPHAM.md if missing
-  if (!existsSync(miphamPath)) {
-    const projectName = cwd.split('/').pop() || 'my-project'
-    const defaultMipham = `---
-model: mipham-code
-version: 1.0.0
-privacy: project
-language: zh-CN
----
-
-# MIPHAM.md — ${projectName}
-
-> 本文件定义 ${projectName} 项目中 AI 助手的交互人格和项目规范。
-> 继承自 One Mipham Corporation 集团 MIPHAM.md。
-
----
-
-## 项目概述
-
-[简要描述项目目的和定位]
-
-## 技术栈
-
-[列出主要技术栈]
-
-## 项目规范
-
-- [添加项目特有的编码规则]
-- [添加团队约定]
-
-## AI 交互偏好
-
-- 回复语言：[中文/英文]
-- 代码风格：[偏好]
-- 注释语言：[中文/英文]
-`
-    writeFileSync(miphamPath, defaultMipham, 'utf-8')
-    created.push('MIPHAM.md')
-  } else {
-    skipped.push('MIPHAM.md (already exists)')
-  }
-
-  const lines: string[] = ['── Step 1: Initialize Project ──', '']
-  if (created.length > 0) {
-    lines.push('Created:')
-    for (const c of created) lines.push(`  ✅ ${c}`)
-  }
-  if (skipped.length > 0) {
-    lines.push('')
-    lines.push('Skipped (already configured):')
-    for (const s of skipped) lines.push(`  ⏭  ${s}`)
-  }
-  lines.push('')
-  lines.push('Next: /setup 2 to configure providers')
-
-  return { content: lines.join('\n') }
-}
-
-async function setupStep2(ctx: CommandContext): Promise<CommandResult> {
-  const active = ctx.config.providers.filter((p) => p.status === 'active')
-  const upcoming = ctx.config.providers.filter((p) => p.status === 'upcoming')
-
-  const lines: string[] = [
-    '── Step 2: Configure Providers ──',
-    '',
-    `Active providers (${active.length}):`,
-    ...active.map((p) => `  ✅ ${p.id.padEnd(14)} ${p.name.padEnd(20)} ${p.protocol}`),
-    '',
-    `Upcoming (${upcoming.length}):`,
-    ...upcoming.map((p) => `  🔶 ${p.id.padEnd(14)} ${p.name.padEnd(20)} ${p.protocol}`),
-    '',
-    '── API Key Setup ──',
-    '',
-    'Set API keys via environment variables or .mipham/config.yml:',
-    '',
-    '  export ANTHROPIC_API_KEY="sk-ant-..."',
-    '  export OPENAI_API_KEY="sk-..."',
-    '  export DEEPSEEK_API_KEY="sk-..."',
-    '  export QWEN_API_KEY="sk-..."',
-    '  export DOUBAO_API_KEY="..."',
-    '  export HUNYUAN_API_KEY="..."',
-    '',
-    'Or add to ~/.mipham/config.yml:',
-    '  providers:',
-    '    - id: anthropic',
-    '      apiKey: $ANTHROPIC_API_KEY',
-    '',
-    'Current: ' + ctx.providerId + ' / ' + ctx.modelId,
-    '',
-    'Next: /setup 3 to choose default model',
-  ]
-
-  return { content: lines.join('\n') }
-}
-
-async function setupStep3(ctx: CommandContext): Promise<CommandResult> {
-  const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
-
-  const lines: string[] = [
-    '── Step 3: Set Default Model ──',
-    '',
-    `Current: ${ctx.providerId} / ${ctx.modelId}`,
-    '',
-    'Available providers & models:',
-    '',
-  ]
-
-  for (const p of activeProviders) {
-    lines.push(`  ${p.id}${p.id === ctx.providerId ? ' ← current' : ''}`)
-    for (const m of p.models.filter((m) => m.status === 'active')) {
-      const marker = m.id === ctx.modelId ? ' ★' : '  '
-      lines.push(
-        `${marker}  ${m.id.padEnd(30)} ${m.contextWindow.toLocaleString()} ctx  ${m.vision ? '🖼' : '📝'}`,
-      )
-    }
-    lines.push('')
-  }
-
-  lines.push('To switch: /switch <provider> <model>')
-  lines.push('To make permanent: edit .mipham/config.yml → defaultProvider / defaultModel')
-  lines.push('')
-  lines.push('Next: /setup 4 to install skills')
-
-  return { content: lines.join('\n') }
-}
-
-async function setupStep4(ctx: CommandContext): Promise<CommandResult> {
-  const counts = ctx.skillsLoader?.countByType() ?? { standard: 0, mipham: 0, total: 0 }
-  const standardNames = ctx.skillsLoader?.getNamesByType('standard') ?? []
-  const miphamNames = ctx.skillsLoader?.getNamesByType('mipham') ?? []
-
-  return {
-    content: `── Step 4: Install Skills ──
-
-Skills extend Mipham Code with specialized capabilities.
-
-Built-in skills (${counts.total} total):
-  Standard (${counts.standard}):  ${standardNames.join(', ')}
-  Mipham (${counts.mipham}):    ${miphamNames.join(', ')}
-
-Community skills:
-  Coming soon — the Mipham Code skills marketplace will let you
-  browse and install community-contributed skills.
-
-  For now, add custom skills manually:
-  1. Create a .SKILL.md file in .mipham/skills/
-  2. Use /reload-skills to load it
-
-Skill file template:
-  ---
-  name: my-skill
-  description: What this skill does
-  version: 1.0.0
-  type: standard
-  ---
-  # My Skill
-  [instructions for the AI]
-
-Next: /setup 5 to configure permissions`,
-  }
-}
-
-async function setupStep5(ctx: CommandContext): Promise<CommandResult> {
-  return {
-    content: `── Step 5: Permissions Setup ──
-
-Current mode: ${ctx.config.permission}
-
-Permission levels:
-  auto    — Run tools automatically (suitable for sandboxed envs)
-  ask     — Prompt before each tool execution (default, recommended)
-  bypass  — Skip all checks (⚠ only for trusted codebases)
-
-  Change with: /config permission <level>
-
-Available tools (${ctx.engine.getTools().size}):
-  File:  read, write, edit, glob, grep
-  Exec:  bash, git, task
-  Agent: agent, memory, plan, skill
-  Net:   web-fetch, web-search
-  Sys:   config, mcp
-
-Each tool category can be configured independently in .mipham/config.yml:
-  permissions:
-    file: ask
-    exec: ask
-    network: auto
-
-Next: /setup 6 for shell integration`,
-  }
-}
-
-async function setupStep6(_ctx: CommandContext): Promise<CommandResult> {
-  return {
-    content: `── Step 6: Shell Integration ──
-
-Add Mipham Code to your shell:
-
-  # Add to ~/.zshrc or ~/.bashrc
-  alias mipham='cd ~/your-project && bun run ~/path/to/mipham-code/apps/cli/bin/mipham.ts'
-
-  # Or if installed globally:
-  alias mipham='mipham'
-
-IDE Integration:
-  VS Code     — coming soon (extension marketplace)
-  JetBrains   — coming soon (plugin)
-  Terminal    — run \`mipham\` in any terminal
-
-Quick launch:
-  Ctrl+P      Open model picker
-  /help       Show all commands
-  Esc         Exit
-
-── Setup Complete! ──
-
-You're all set. Start a conversation:
-  "help me build a REST API"
-  "review my code"
-  "explain this project"
-
-For help at any time: /help`,
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Theme — display theme toggle
-// ═══════════════════════════════════════════════════════════════
-
-const themeCmd: CommandHandler = (_ctx, args) => {
-  const theme = args[0]?.toLowerCase()
-  const validThemes = ['dark', 'light', 'auto'] as const
-
-  if (!theme || !validThemes.includes(theme as (typeof validThemes)[number])) {
-    return {
-      content: `── Theme ──
-
-Terminal color themes (set in .mipham/config.yml):
-
-  theme: dark    — dark background (default, recommended for terminals)
-  theme: light   — light background
-  theme: auto    — follow system preference
-
-Usage: /theme dark | light | auto
-
-Current: auto (follows terminal)`,
-    }
-  }
-
-  return {
-    content: `✓ Theme set to "${theme}".
-
-Add to ~/.mipham/config.yml to persist:
-  theme: ${theme}
-
-Terminal themes affect syntax highlighting and UI accents.
-Full theme customization is available in the Web UI at https://mipham.ai/code/dashboard`,
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Add-Dir — add a directory to workspace permissions
-// ═══════════════════════════════════════════════════════════════
-
-const addDirCmd: CommandHandler = async (_ctx, args) => {
-  const dir = args[0]
-  if (!dir) {
-    return {
-      content: `Usage: /add-dir <path>
-
-Add a directory to Mipham Code's allowed workspace paths.
-This grants the AI permission to read/write files in that directory.
-
-Examples:
-  /add-dir ~/projects/my-api
-  /add-dir /usr/local/share/data
-
-Current allowed directories:
-  • ${process.cwd()}  (project root, always allowed)
-
-Note: For security, tools like bash already respect .mipham/config.yml
-permission boundaries. Adding directories here extends read/write access.`,
-    }
-  }
-
-  const { existsSync } = await import('node:fs')
-  const { resolve } = await import('node:path')
-  const resolved = resolve(dir.replace(/^~/, process.env.HOME || '~'))
-
-  if (!existsSync(resolved)) {
-    return { content: `✗ Directory not found: ${resolved}\n\nCheck the path and try again.` }
-  }
-
-  return {
-    content: `✓ Directory registered: ${resolved}
-
-To persist across sessions, add to .mipham/config.yml:
-  workspace:
-    extraDirs:
-      - ${resolved}
-
-The AI can now access files in this directory.
-Permission level is controlled by /config permission <level>.`,
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Security / Audit — security review checklist
-// ═══════════════════════════════════════════════════════════════
-
-const promptAuditCmd: CommandHandler = async () => {
-  const { existsSync, readFileSync, readdirSync, statSync } = await import('node:fs')
-  const { join, extname, basename } = await import('node:path')
-  const cwd = process.cwd()
-
-  // Patterns that suggest prompts written for older/less-capable models
-  const AUDIT_RULES: Array<{
-    id: string
-    pattern: RegExp
-    severity: 'low' | 'medium' | 'high'
-    message: string
-    suggestion: string
-  }> = [
-    {
-      id: 'over-explaining',
-      pattern:
-        /you are (a|an) (helpful |friendly |knowledgeable )?(AI |language model |assistant)/i,
-      severity: 'low',
-      message: 'Self-identification preamble ("You are a...")',
-      suggestion: "Modern models don't need role preamble. Remove or shorten to 1 line.",
-    },
-    {
-      id: 'step-by-step',
-      pattern: /(think|reason|work) (step[ -]?by[ -]?step|through this|carefully about this)/i,
-      severity: 'low',
-      message: 'Step-by-step reasoning prompt',
-      suggestion: 'Reasoning models handle this natively. Remove for token savings.',
-    },
-    {
-      id: 'do-not-list',
-      pattern:
-        /(do not|never|you must not|don't|under no circumstances).*\n.*(do not|never|you must not|don't)/i,
-      severity: 'medium',
-      message: 'Multiple "do not" constraints',
-      suggestion: 'Modern models need fewer prohibitions. Consolidate to 1-2 key constraints.',
-    },
-    {
-      id: 'token-waste',
-      pattern:
-        /(remember|keep in mind|it is important to note|please note that|i want to emphasize)/i,
-      severity: 'low',
-      message: 'Filler emphasis phrases ("remember", "please note")',
-      suggestion: 'Remove filler. State the instruction directly.',
-    },
-    {
-      id: 'format-over-spec',
-      pattern: /(you must (always |only )?respond (in|with|using) (JSON|XML|YAML|markdown|HTML))/i,
-      severity: 'low',
-      message: 'Over-specified output format',
-      suggestion: 'Modern models follow format instructions with fewer words. Shorten.',
-    },
-    {
-      id: 'example-overload',
-      pattern: /((?:example|for instance|e\.g\.,).*\n){3,}/i,
-      severity: 'low',
-      message: 'Three or more examples in sequence',
-      suggestion: '1-2 examples suffice for modern models. Remove redundant ones.',
-    },
-    {
-      id: 'old-model-ref',
-      pattern: /(GPT-3|GPT-3\.5|Claude\s*[12][^3]|text-davinci|command-r|llama\s*2)/i,
-      severity: 'high',
-      message: 'Reference to older model',
-      suggestion: 'Update model references to current generation (Sonnet 5, Opus 5, GPT-5, etc.).',
-    },
-    {
-      id: 'long-preamble',
-      pattern: /^.{200,}$/m,
-      severity: 'medium',
-      message: 'Very long single-line instructions (200+ chars)',
-      suggestion: 'Break into bullet points. Modern models parse structured prompts better.',
-    },
-    {
-      id: 'verbose-constraint',
-      pattern:
-        /you (must|should|shall) (always |only |never )?(ensure|guarantee|verify|validate|confirm|cross-check|double-check)/i,
-      severity: 'medium',
-      message: 'Overly verbose constraint language',
-      suggestion: 'Replace "you must ensure that" with imperative: "Ensure".',
-    },
-  ]
-
-  // Files to scan
-  const scanDirs = [
-    join(cwd, '.mipham', 'skills'),
-    join(cwd, '.mipham', 'rules'),
-    join(cwd, '.claude'),
-  ]
-  const skillFiles: string[] = []
-  // Also check standard project files
-  const projectFiles = [join(cwd, 'CLAUDE.md'), join(cwd, 'MIPHAM.md'), join(cwd, 'PRODUCT.md')]
-
-  // Collect skill/rules files
-  for (const dir of scanDirs) {
-    try {
-      if (!existsSync(dir)) continue
-      const walk = (d: string) => {
-        const entries = readdirSync(d)
-        for (const e of entries) {
-          const fp = join(d, e)
-          const st = statSync(fp)
-          if (st.isDirectory()) {
-            walk(fp)
-            continue
-          }
-          if (['.md', '.SKILL.md', '.mipham-skill.md', '.txt'].some((ext) => fp.endsWith(ext))) {
-            skillFiles.push(fp)
-          }
-        }
-      }
-      walk(dir)
-    } catch {
-      /* skip */
-    }
-  }
-
-  const allFiles = [...new Set([...projectFiles.filter((f) => existsSync(f)), ...skillFiles])]
-
-  if (allFiles.length === 0) {
-    return {
-      content: [
-        '🔍 Prompt Audit',
-        '',
-        'No prompt files found to audit.',
-        'Place skills in .mipham/skills/ and rules in .mipham/rules/.',
-      ].join('\n'),
-    }
-  }
-
-  // Scan each file
-  const results: Array<{
-    file: string
-    line: number
-    ruleId: string
-    severity: string
-    message: string
-    suggestion: string
-  }> = []
-
-  for (const fp of allFiles) {
-    try {
-      const content = readFileSync(fp, 'utf-8')
-      const lines = content.split('\n')
-      for (const rule of AUDIT_RULES) {
-        // Multi-line pattern: check full content
-        if (rule.id === 'do-not-list' || rule.id === 'example-overload') {
-          if (rule.pattern.test(content)) {
-            // Find approx line
-            const match = rule.pattern.exec(content)
-            const idx = match ? content.slice(0, match.index).split('\n').length : 1
-            results.push({
-              file: fp.replace(cwd + '/', ''),
-              line: idx,
-              ruleId: rule.id,
-              severity: rule.severity,
-              message: rule.message,
-              suggestion: rule.suggestion,
-            })
-          }
-          continue
-        }
-
-        // Line-by-line patterns
-        for (let i = 0; i < lines.length; i++) {
-          const line = lines[i]!
-          if (rule.pattern.test(line)) {
-            results.push({
-              file: fp.replace(cwd + '/', ''),
-              line: i + 1,
-              ruleId: rule.id,
-              severity: rule.severity,
-              message: rule.message,
-              suggestion: rule.suggestion,
-            })
-          }
-        }
-      }
-    } catch {
-      /* skip unreadable files */
-    }
-  }
-
-  // Format output
-  const severityIcon: Record<string, string> = { high: '🔴', medium: '🟡', low: '🟢' }
-  const grouped: Record<string, typeof results> = {}
-  for (const r of results) {
-    const key = r.file
-    if (!grouped[key]) grouped[key] = []
-    grouped[key]!.push(r)
-  }
-
-  const output: string[] = [
-    `🔍 Prompt Audit — ${allFiles.length} file(s) scanned, ${results.length} finding(s)`,
-    '',
-  ]
-
-  if (results.length === 0) {
-    output.push('✅ All prompts look optimized for modern models. No issues found.')
-  } else {
-    for (const [file, items] of Object.entries(grouped)) {
-      output.push(`📄 ${file} (${items!.length} finding${items!.length > 1 ? 's' : ''})`)
-      for (const item of items!) {
-        output.push(
-          `  ${severityIcon[item.severity] || '⚪'} L${item.line}: [${item.ruleId}] ${item.message}`,
-        )
-        output.push(`     → ${item.suggestion}`)
-      }
-      output.push('')
-    }
-  }
-
-  output.push('─'.repeat(60))
-  output.push('Scanned: ' + allFiles.map((f) => basename(f)).join(', '))
-
-  return { content: output.join('\n') }
-}
-
-const securityCmd: CommandHandler = async () => {
-  const findings: string[] = []
-  const ok: string[] = []
-
-  // Check for common security issues
-  const { existsSync, readFileSync } = await import('node:fs')
-  const { join } = await import('node:path')
-  const cwd = process.cwd()
-
-  // 1. Check .gitignore for sensitive patterns
-  if (existsSync(join(cwd, '.gitignore'))) {
-    const gi = readFileSync(join(cwd, '.gitignore'), 'utf-8')
-    const hasEnv = gi.includes('.env')
-    const hasKeys = gi.includes('*.key') || gi.includes('*.pem')
-    if (hasEnv && hasKeys) {
-      ok.push('.gitignore covers .env + key files')
-    } else {
-      findings.push('Add .env, *.key, *.pem to .gitignore')
-    }
-  } else {
-    findings.push('No .gitignore found — create one with .env, node_modules, dist')
-  }
-
-  // 2. Check for hardcoded secrets (quick grep for common patterns)
-  // ⚠ Security: results are redacted — only file:line locations are shown, never values
-  try {
-    const { execSync } = await import('node:child_process')
-    const secretPatterns = execSync(
-      `grep -rIn --include="*.ts" --include="*.js" --include="*.yml" --include="*.yaml" --include="*.json" -E "(API_KEY|SECRET|PASSWORD|TOKEN)\\s*=\\s*['\\\"][^$]" ${cwd} 2>/dev/null | grep -v node_modules | grep -v '.git/' | head -5 || echo ""`,
-      { encoding: 'utf-8', timeout: 5000 },
-    ).trim()
-    if (secretPatterns) {
-      // Redact the actual values — only show file:line locations
-      const redacted = secretPatterns
-        .split('\n')
-        .map((l) => {
-          const colonIdx = l.indexOf(':')
-          const secondColon = l.indexOf(':', colonIdx + 1)
-          if (secondColon > 0) {
-            return '    ' + l.slice(0, secondColon) + ' [VALUE REDACTED]'
-          }
-          return '    ' + l + ' [REDACTED]'
-        })
-        .join('\n')
-      findings.push(
-        `⚠ Hardcoded secrets detected (values redacted for security):\n${redacted}\n\n  Replace with env vars: \${VAR_NAME} syntax`,
-      )
-    } else {
-      ok.push('No hardcoded secrets detected')
-    }
-  } catch {
-    // grep may fail if no matches — that's good
-    ok.push('No hardcoded secrets detected (quick scan)')
-  }
-
-  // 3. Check for TLS in dependencies
-  if (existsSync(join(cwd, 'package.json'))) {
-    ok.push('package.json present — dependencies manageable')
-  }
-
-  // 4. Check for license
-  if (existsSync(join(cwd, 'LICENSE'))) {
-    ok.push('LICENSE file present')
-  } else {
-    findings.push('No LICENSE file — add Apache 2.0 or appropriate license')
-  }
-
-  // 5. CI/CD
-  if (existsSync(join(cwd, '.github', 'workflows'))) {
-    ok.push('CI/CD workflows configured')
-  } else {
-    findings.push('No CI/CD workflows found — add .github/workflows/')
-  }
-
-  const lines: string[] = ['── Security Review ──', '', `Scanning: ${cwd}`, '']
-
-  if (ok.length > 0) {
-    lines.push(`✅ Passed (${ok.length}):`)
-    for (const o of ok) lines.push(`  • ${o}`)
-  }
-  if (findings.length > 0) {
-    lines.push('')
-    lines.push(`⚠  Findings (${findings.length}):`)
-    for (const f of findings) lines.push(`  • ${f}`)
-  }
-  lines.push('')
-  lines.push('For a full audit: type "audit my project for security issues" in chat.')
-
-  return { content: lines.join('\n') }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Release Notes — version changelog
-// ═══════════════════════════════════════════════════════════════
-
-const releaseNotesCmd: CommandHandler = () => ({
-  content: `── Release Notes ──
-
-v0.1.2 (2026-06-09) — Current
-  • 48 slash commands (up from 20)
-  • /setup guided project initialization wizard
-  • Checkpoint/rewind mechanism
-  • Focus mode (last exchange view)
-  • 3-level MIPHAM.md architecture
-  • /doctor system diagnostics
-  • /export conversation to file
-  • /review and /pr-comments code review workflows
-  • /memory management
-  • /upgrade instructions
-  • Clipboard support (macOS/Windows)
-
-v0.1.1 (2026-06-02)
-  • Inline shared module for standalone builds
-  • Bin path fix for npm compatibility
-
-v0.1.0 (2026-06-01)
-  • Initial release
-  • Multi-model support (7 providers)
-  • 16 built-in tools
-  • 11 skills (9 standard + 2 mipham)
-  • Ctrl+P interactive model picker
-  • SSE streaming support
-
-Full changelog: https://mipham.ai/code/releases`,
-})
-
-// ═══════════════════════════════════════════════════════════════
-// IDE — IDE integration guide
-// ═══════════════════════════════════════════════════════════════
-
-const ideCmd: CommandHandler = async (_ctx) => {
-  const { mkdirSync, writeFileSync, existsSync } = await import('node:fs')
-  const { join } = await import('node:path')
-
-  const cwd = process.cwd()
-  const vscodeDir = join(cwd, '.vscode')
-  mkdirSync(vscodeDir, { recursive: true })
-
-  const files: string[] = []
-
-  // ── Detect bun path ──
-  let bunPath = '/opt/homebrew/bin/bun'
-  try {
-    const { execSync } = await import('node:child_process')
-    const detected = execSync('which bun 2>/dev/null || echo /opt/homebrew/bin/bun', {
-      encoding: 'utf-8',
-    }).trim()
-    if (detected) bunPath = detected
-  } catch {
-    // Use default
-  }
-
-  // ── settings.json: terminal profile ──
-  const settingsPath = join(vscodeDir, 'settings.json')
-  const settings = {
-    'terminal.integrated.profiles.osx': {
-      mipham: {
-        path: bunPath,
-        args: ['run', 'mipham'],
-        cwd: '${workspaceFolder}',
-      },
-    },
-  }
-  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8')
-  files.push('.vscode/settings.json')
-
-  // ── keybindings.json: Cmd+Esc launch ──
-  const keybindingsPath = join(vscodeDir, 'keybindings.json')
-  const keybindings = [
-    {
-      key: 'cmd+escape',
-      command: 'workbench.action.terminal.focus',
-      when: 'terminalProcessSupported',
-    },
-    {
-      key: 'cmd+shift+m',
-      command: 'workbench.action.terminal.new',
-    },
-  ]
-  writeFileSync(keybindingsPath, JSON.stringify(keybindings, null, 2) + '\n', 'utf-8')
-  files.push('.vscode/keybindings.json')
-
-  // ── extensions.json: recommended ──
-  const extensionsPath = join(vscodeDir, 'extensions.json')
-  const extensions = {
-    recommendations: ['miphamai.mipham-code'],
-  }
-  writeFileSync(extensionsPath, JSON.stringify(extensions, null, 2) + '\n', 'utf-8')
-  files.push('.vscode/extensions.json')
-
-  return {
-    content: [
-      '── VS Code Integration ──',
-      '',
-      `Generated in ${vscodeDir}:`,
-      ...files.map((f) => `  ✅ ${f}`),
-      '',
-      'What was configured:',
-      '  • Terminal profile "mipham" — opens Mipham Code in integrated terminal',
-      '  • Keyboard shortcut Cmd+Esc — focus terminal',
-      '  • Cmd+Shift+M — new terminal',
-      '',
-      'To use:',
-      '  1. Restart VS Code (or reload window: Cmd+Shift+P → Reload Window)',
-      '  2. Open terminal: Ctrl+` or Cmd+Esc',
-      '  3. Select "mipham" profile from the terminal dropdown',
-      '',
-      'Install the VS Code extension for full integration:',
-      `  code --install-extension miphamai.mipham-code`,
-      '',
-      'JetBrains: Settings → Tools → Terminal → Shell path → bun run mipham',
-    ].join('\n'),
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Terminal Setup — shell integration guide
-// ═══════════════════════════════════════════════════════════════
-
-const terminalSetupCmd: CommandHandler = async () => {
-  const { writeFileSync, appendFileSync, existsSync, mkdirSync, readFileSync } =
-    await import('node:fs')
-  const { join } = await import('node:path')
-  const { homedir } = await import('node:os')
-
-  const home = homedir()
-  const lines: string[] = ['── Terminal Setup ──', '']
-
-  // ── 1. Generate standalone shell setup script ──
-  const miphamDir = join(home, '.mipham')
-  mkdirSync(miphamDir, { recursive: true })
-
-  const shellScript = join(miphamDir, 'shell-setup.sh')
-  const shellContent = [
-    '#!/bin/bash',
-    '# Mipham Code — Shell Integration',
-    '# Source this file in your shell profile:',
-    '#   source ~/.mipham/shell-setup.sh',
-    '',
-    `export MIPHAM_HOME="${home}/.mipham"`,
-    '',
-    '# Alias: launch Mipham Code in current directory',
-    `alias mipham='cd $(pwd) && ${NPM_INSTALL_COMMAND} > /dev/null 2>&1; mipham'`,
-    '',
-    '# Or use the local development version:',
-    '# alias mipham="bun run /path/to/mipham-code/apps/cli/bin/mipham"',
-    '',
-    '# Auto-detect provider from config',
-    'if [ -f ~/.mipham/config.yml ]; then',
-    '  export MIPHAM_PROVIDER=$(grep "defaultProvider:" ~/.mipham/config.yml | awk "{print \$2}")',
-    'fi',
-  ].join('\n')
-  writeFileSync(shellScript, shellContent + '\n', 'utf-8')
-  lines.push(`  ✅ Generated: ${shellScript}`)
-
-  // ── 2. Append to shell profile ──
-  const shell = process.env.SHELL || '/bin/zsh'
-  const profileName = shell.includes('zsh') ? '.zshrc' : '.bashrc'
-  const profilePath = join(home, profileName)
-  const sourceLine = `\n# Mipham Code shell integration\n[ -f ~/.mipham/shell-setup.sh ] && source ~/.mipham/shell-setup.sh\n`
-
-  try {
-    const existing = existsSync(profilePath) ? readFileSync(profilePath, 'utf-8') : ''
-    if (existing.includes('shell-setup.sh')) {
-      lines.push(`  ⏭  ${profileName} already has Mipham Code integration`)
-    } else {
-      appendFileSync(profilePath, sourceLine, 'utf-8')
-      lines.push(`  ✅ Added to ~/${profileName}`)
-    }
-  } catch {
-    lines.push(`  ⚠️  Could not update ~/${profileName}. Add manually:`)
-    lines.push(`     echo '${sourceLine.trim()}' >> ~/${profileName}`)
-  }
-
-  // ── 3. Global install check ──
-  lines.push('')
-  lines.push('── Installation ──')
-  try {
-    const { execSync } = await import('node:child_process')
-    const miphamPath = execSync('which mipham 2>/dev/null || echo ""', { encoding: 'utf-8' }).trim()
-    if (miphamPath) {
-      lines.push(`  ✅ mipham found at: ${miphamPath}`)
-      const version = execSync('mipham --version 2>/dev/null || echo "unknown"', {
-        encoding: 'utf-8',
-      }).trim()
-      lines.push(`  📦 Version: ${version}`)
-    } else {
-      lines.push(`  ⚠️  mipham not in PATH. Install globally:`)
-      lines.push(`     ${NPM_INSTALL_COMMAND}`)
-      lines.push(`     or: curl -fsSL https://mipham.ai/install.sh | bash`)
-    }
-  } catch {
-    lines.push(`  💡 Install: ${NPM_INSTALL_COMMAND}`)
-  }
-
-  // ── 4. Verify ──
-  lines.push('')
-  lines.push('── Next Steps ──')
-  lines.push('  1. Restart your terminal or run: source ~/.mipham/shell-setup.sh')
-  lines.push('  2. Run: mipham --version')
-  lines.push('  3. Start coding: cd your-project && mipham')
-  lines.push('')
-  lines.push(`Works with: Zsh, Bash. Shell: ${shell}`)
-
-  return { content: lines.join('\n') }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Phase 4 — MCP Server Management
-// ═══════════════════════════════════════════════════════════════
-
-const mcpCmd: CommandHandler = (ctx) => {
-  const configuredServers = ctx.config.skills?.mcpServers ?? []
-  const liveConnections = McpClient.getInstance().listConnections()
-
-  const lines: string[] = ['── MCP Servers ──', '']
-
-  if (configuredServers.length > 0) {
-    lines.push(`Configured servers (${configuredServers.length}):`)
-    lines.push('')
-    for (const s of configuredServers) {
-      const live = liveConnections.find((c) => c.config.name === s.name)
-      const statusIcon = live
-        ? live.status === 'connected'
-          ? '🟢'
-          : live.status === 'connecting'
-            ? '🟡'
-            : live.status === 'error'
-              ? '🔴'
-              : '⚪'
-        : '⚪'
-      const statusLabel = live ? live.status : 'not started'
-      const envKeys = s.env ? Object.keys(s.env).join(', ') : '(none)'
-
-      lines.push(`  ${statusIcon} ${s.name}  [${statusLabel}]`)
-      lines.push(`     Command: ${s.command} ${s.args.join(' ')}`)
-      lines.push(`     Env vars: ${envKeys}`)
-      if (live?.tools && live.tools.length > 0) {
-        lines.push(`     Tools: ${live.tools.map((t) => t.name).join(', ')}`)
-      }
-      if (live?.error) {
-        lines.push(`     Error: ${live.error}`)
-      }
-      if (live?.serverInfo) {
-        lines.push(`     Server: ${live.serverInfo.name} v${live.serverInfo.version}`)
-      }
-      lines.push('')
-    }
-  } else {
-    lines.push('No MCP servers configured.')
-    lines.push('')
-    lines.push('── Configuration ──')
-    lines.push('')
-    lines.push('Add MCP servers to .mipham/config.yml:')
-    lines.push('')
-    lines.push('  skills:')
-    lines.push('    mcpServers:')
-    lines.push('      - name: filesystem')
-    lines.push('        command: npx')
-    lines.push('        args: ["-y", "@anthropic/mcp-filesystem", "/path"]')
-    lines.push('        env:')
-    lines.push('          HOME: $HOME')
-    lines.push('')
-    lines.push('      - name: github')
-    lines.push('        command: npx')
-    lines.push('        args: ["-y", "@anthropic/mcp-github"]')
-    lines.push('        env:')
-    lines.push('          GITHUB_TOKEN: $GITHUB_TOKEN')
-    lines.push('')
-    lines.push('After configuring, restart Mipham Code to connect.')
-    lines.push('Use the MCP tool (Tool 16) to call server tools.')
-  }
-
-  lines.push('')
-  lines.push('── Protocol ──')
-  lines.push('MCP stdio transport (JSON-RPC 2.0) — fully implemented.')
-  lines.push('Servers auto-connect on startup when configured.')
-  lines.push('')
-  lines.push('Learn more: https://modelcontextprotocol.io')
-
-  return { content: lines.join('\n') }
-}
-
-// ═══════════════════════════════════════════════════════════════
-// Phase 4 — Login / API Key Management
-// ═══════════════════════════════════════════════════════════════
-
-const loginCmd: CommandHandler = (ctx) => {
-  const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
-
-  // Map provider IDs to their expected env var names
-  const providerEnvMap: Record<string, string> = {
-    anthropic: 'ANTHROPIC_API_KEY',
-    openai: 'OPENAI_API_KEY',
-    deepseek: 'DEEPSEEK_API_KEY',
-    google: 'GEMINI_API_KEY',
-    qwen: 'QWEN_API_KEY',
-    doubao: 'DOUBAO_API_KEY',
-    hunyuan: 'HUNYUAN_API_KEY',
+  // Map provider IDs to their expected env var names
+  const providerEnvMap: Record<string, string> = {
+    anthropic: 'ANTHROPIC_API_KEY',
+    openai: 'OPENAI_API_KEY',
+    deepseek: 'DEEPSEEK_API_KEY',
+    google: 'GEMINI_API_KEY',
+    qwen: 'QWEN_API_KEY',
+    doubao: 'DOUBAO_API_KEY',
+    hunyuan: 'HUNYUAN_API_KEY',
   }
 
   const lines: string[] = [
@@ -4271,6 +2998,7 @@ const commandsListCmd: CommandHandler = () => {
     '/undo': 'History',
     '/copy': 'History',
     '/focus': 'History',
+    '/ultracode': 'Workflow',
     '/pick': 'Model & Provider',
     '/model': 'Model & Provider',
     '/models': 'Model & Provider',
@@ -4305,6 +3033,7 @@ const commandsListCmd: CommandHandler = () => {
     '/pr-comments': 'Workflow',
     '/diff': 'Workflow',
     '/workflows': 'Workflow',
+    '/deep-research': 'Workflow',
     '/loop': 'Workflow',
     '/init': 'Project',
     '/setup': 'Project',
@@ -4401,6 +3130,7 @@ registry.set('/rewind', rewindCmd)
 registry.set('/undo', undoCmd)
 registry.set('/copy', copyCmd)
 registry.set('/focus', focusCmd)
+registry.set('/ultracode', ultracodeCmd)
 
 // Model & Provider
 registry.set('/model', modelCmd)
@@ -4437,6 +3167,7 @@ registry.set('/loop', loopCmd)
 registry.set('/no-plan', noPlanCmd)
 registry.set('/workflow', workflowAutoCmd)
 registry.set('/workflows', workflowsCmd)
+registry.set('/deep-research', deepResearchCmd)
 registry.set('/review', reviewCmd)
 registry.set('/pr-comments', prCommentsCmd)
 
@@ -4540,6 +3271,7 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/undo': 'Same as /rewind',
   '/copy': 'Copy last response to clipboard',
   '/focus': 'Toggle focus view',
+  '/ultracode': 'Toggle multi-agent workflow orchestration mode',
   '/pick': 'Open model picker',
   '/model': 'Show current model',
   '/models': 'List all available models',
@@ -4572,6 +3304,8 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/pr-comments': 'PR review summary',
   '/diff': 'Show git diff',
   '/workflows': 'List workflow scripts',
+  '/deep-research':
+    'Deep research with multi-agent parallel search, verification, and cited synthesis',
   '/loop': 'Run prompt on interval',
   '/init': 'Initialize .mipham config',
   '/setup': 'Guided project setup wizard',
@@ -4629,22 +3363,6 @@ export function parseSlashCommand(input: string): { command: string; args: strin
   return { command, args }
 }
 
-// ── Utility ──
-
-function stripIndent(strings: TemplateStringsArray, ...values: unknown[]): string {
-  let result = strings.reduce((acc, s, i) => acc + s + (values[i] ?? ''), '')
-  // Remove leading newline
-  result = result.replace(/^\n/, '')
-  // Find minimum indent
-  const match = result.match(/^( +)/m)
-  if (match?.[1]) {
-    const indent = match[1].length
-    result = result
-      .split('\n')
-      .map((line) => line.slice(indent))
-      .join('\n')
-  }
-  return result.trim()
-}
+export { stripIndent } from './strip-indent.js'
 
 export { switchCmd as handleSwitch }