@miphamai/cli 0.5.7 → 0.5.9

package/src/ui/commands.ts

@@ -49,107 +49,127 @@ type CommandHandler = (
 // Session & Identity
 // ═══════════════════════════════════════════════════════════════
 
-const helpCmd: CommandHandler = (_ctx) => ({
-  content: stripIndent`
-    Mipham Code v${PACKAGE_VERSION} — Commands
-
-    ── Session ──────────────────────────
-    /help          Show this help
-    /version       Show version info
-    /clear         Clear conversation
-    /compact       Compact context window
-    /context       Show context stats
-    /status        Session and system status
-    /cost          Token usage estimate
-    /usage         Detailed usage dashboard
-    /rename <name> Rename current session
-    /goal <text>   Set session goal
-    /recap         Summarize session so far
-    /export        Export conversation to file
-    /doctor        System diagnostics
-    /resume        List saved sessions
-    /branch <name> Fork conversation
-
-    ── History ─────────────────────────
-    /rewind        Undo last AI turn
-    /undo          Same as /rewind
-    /copy [N]      Copy last response to clipboard
-    /focus         Toggle focus view (last exchange only)
-
-    ── Model & Provider ────────────────
-    /pick          Open model picker (or Ctrl+P)
-    /model         Show current model
-    /models        List all available models
-    /provider      Show current provider
-    /providers     List configured providers
-    /switch <p> <m> Switch provider and model
-    /config        View configuration
-    /fast [on|off] Toggle fast mode
-    /effort <lvl>  Set reasoning effort (low|medium|high|xhigh|max)
-    /theme [dark|light|auto] Set terminal theme
-
-    ── Tools & Skills ──────────────────
-    /tools         List available tools (16 total)
-    /skills        List loaded skills (14 built-in)
-    /reload-skills Reload all skills
-    /mcp           MCP server status
-
-    ── Workflow ────────────────────────
-    /plan          Enter plan mode (read-only)
-    /no-plan       Exit plan mode
-    /tdd           TDD mode              [stub]
-    /todos         Task management
-    /tasks         Background tasks
-    /review        Code review workflow
-    /pr-comments   PR review summary
-    /diff          Show git diff
-    /workflows     List workflow scripts
-    /loop <int> <p> Run prompt on interval
-    /schedule      View scheduled tasks   [stub]
-
-    ── Project ─────────────────────────
-    /init          Initialize .mipham config
-    /setup         Guided project setup wizard
-    /permissions   Show permission settings
-    /add-dir <dir> Add workspace directory
-    /security      Security review checklist
-    /audit         Same as /security
-
-    ── Environment ─────────────────────
-    /upgrade       Show upgrade instructions
-    /release-notes View version changelog
-    /ide           IDE integration guide
-    /terminal-setup Shell & terminal config
-    /memory        Manage AI memories
-
-    ── Account ─────────────────────────
-    /login         Show API key status
-    /logout        Clear credentials guide
-    /feedback      Send feedback
-
-    ── Agents ──────────────────────────
-    /agents        Agent view dashboard
-    /bg <prompt>   Run a background agent task
-
-    Type /exit or Esc to quit.
-  `,
-})
+const helpCmd: CommandHandler = (ctx) => {
+  const skillCount = ctx.skillsLoader?.list().length ?? 14
+  const toolsCount = ctx.engine.getTools().size
+  const cmdCount = getCommandNames().length
 
-const versionCmd: CommandHandler = (ctx) => ({
-  content: stripIndent`
-    Mipham Code v${ctx.version}
+  return {
+    content: stripIndent`
+      Mipham Code v${PACKAGE_VERSION} — Commands
+
+      ── Session ──────────────────────────
+      /help          Show this help
+      /commands      List all ${cmdCount} commands
+      /version       Show version info
+      /clear         Clear conversation
+      /compact       Compact context window
+      /context       Show context stats
+      /status        Session and system status
+      /cost          Token usage estimate
+      /usage         Detailed usage dashboard
+      /rename <name> Rename current session
+      /goal <text>   Set session goal
+      /recap         Summarize session so far
+      /export        Export conversation to file
+      /doctor        System diagnostics
+      /resume        List saved sessions
+      /branch <name> Fork conversation
+
+      ── History ─────────────────────────
+      /rewind        Undo last AI turn
+      /undo          Same as /rewind
+      /copy [N]      Copy last response to clipboard
+      /focus         Toggle focus view (last exchange only)
+
+      ── Model & Provider ────────────────
+      /pick          Open model picker (or Ctrl+P)
+      /model         Show current model
+      /models        List all available models
+      /provider      Show current provider
+      /providers     List configured providers
+      /switch <p> <m> Switch provider and model
+      /config        View configuration
+      /fast [on|off] Toggle fast mode
+      /effort <lvl>  Set reasoning effort (low|medium|high|xhigh|max)
+      /theme [dark|light|auto] Set terminal theme
+
+      ── Tools & Skills ──────────────────
+      /tools         List available tools (${toolsCount} total)
+      /skills        List loaded skills (${skillCount} built-in)
+      /reload-skills Reload all skills
+      /browse-skills Browse community skill marketplace
+      /install-skill Install a skill by name or URL
+      /remove-skill  Remove an installed skill
+      /commands      List all slash commands
+      /mcp           MCP server status
+
+      ── Workflow ────────────────────────
+      /plan          Enter plan mode (read-only)
+      /no-plan       Exit plan mode
+      /tdd           TDD mode              [stub]
+      /todos         Task management
+      /tasks         Background tasks
+      /review        Code review workflow
+      /pr-comments   PR review summary
+      /diff          Show git diff
+      /workflows     List workflow scripts
+      /loop <int> <p> Run prompt on interval
+      /schedule      View scheduled tasks   [stub]
+
+      ── Project ─────────────────────────
+      /init          Initialize .mipham config
+      /setup         Guided project setup wizard
+      /recommend     Analyze project + recommend setup
+      /permissions   Show permission settings
+      /add-dir <dir> Add workspace directory
+      /security      Security review checklist
+      /audit         Same as /security
+
+      ── Environment ─────────────────────
+      /upgrade       Show upgrade instructions
+      /release-notes View version changelog
+      /ide           IDE integration guide
+      /terminal-setup Shell & terminal config
+      /memory        Manage AI memories
+
+      ── Account ─────────────────────────
+      /login         Show API key status
+      /logout        Clear credentials guide
+      /feedback      Send feedback
+
+      ── Agents ──────────────────────────
+      /agents        Agent view dashboard
+      /bg <prompt>   Run a background agent task
+
+      Type /exit or Esc to quit.
+    `,
+  }
+}
 
-    Runtime:  Bun ${typeof Bun !== 'undefined' ? Bun.version : '(Node.js)'}
-    Platform: ${process.platform} ${process.arch}
-    Node:     ${process.version}
-    CWD:      ${process.cwd()}
+const versionCmd: CommandHandler = (ctx) => {
+  const skillCounts = ctx.skillsLoader?.countByType()
+  const skillsLine = skillCounts
+    ? `Skills:   ${skillCounts.total} built-in (${skillCounts.standard} standard + ${skillCounts.mipham} mipham)`
+    : `Skills:   (loader unavailable)`
+  const toolsCount = ctx.engine.getTools().size
 
-    Provider: ${ctx.providerId} / ${ctx.modelId}
-    Tools:    16 built-in
-    Skills:   14 built-in (12 standard + 2 mipham)
-    License:  Apache 2.0
-  `,
-})
+  return {
+    content: stripIndent`
+      Mipham Code v${ctx.version}
+
+      Runtime:  Bun ${typeof Bun !== 'undefined' ? Bun.version : '(Node.js)'}
+      Platform: ${process.platform} ${process.arch}
+      Node:     ${process.version}
+      CWD:      ${process.cwd()}
+
+      Provider: ${ctx.providerId} / ${ctx.modelId}
+      Tools:    ${toolsCount} built-in
+      ${skillsLine}
+      License:  Apache 2.0
+    `,
+  }
+}
 
 const clearCmd: CommandHandler = (ctx) => {
   ctx.engine.getContext().clear()
@@ -317,29 +337,25 @@ const toolsCmd: CommandHandler = (ctx) => {
   return { content: `Available tools (${tools.size}):\n\n${sections.join('\n\n')}` }
 }
 
-const skillsCmd: CommandHandler = (_ctx) => ({
-  content: stripIndent`
-    ── Standard Skills (12) ──
-    code-review                  Code review automation (v2.0)
-    compassionate-communication  Warm, respectful, user-centered interaction
-    doc-generator                Generate technical docs from code
-    github-ops                   GitHub PR/issues/releases management
-    memory                       Persistent memory read/write
-    mipham-code-setup            Mipham Code install & config guide
-    security-review              Security audit (OWASP, secrets, supply chain)
-    self-review                  Self-review diff for bugs and cleanup
-    superpower                   Skill discovery and usage guide
-    tdd                          Test-Driven Development workflow
-    web-search                   Web search for current information
-    code-review                  (classic) Legacy code review
-
-    ── Mipham Exclusive (2) ──
-    om-security        Security analysis (injection, PII, adversarial)
-    om-model-optimize  Model optimization (context, caching, tokens)
-
-    14 skills loaded. Use Skill tool to invoke.
-  `,
-})
+const skillsCmd: CommandHandler = (ctx) => {
+  if (!ctx.skillsLoader) {
+    return { content: 'SkillsLoader not available.' }
+  }
+  const counts = ctx.skillsLoader.countByType()
+  const standard = ctx.skillsLoader.listByType('standard')
+  const mipham = ctx.skillsLoader.listByType('mipham')
+
+  const lines: string[] = [
+    `── Standard Skills (${counts.standard}) ──`,
+    ...standard.map((s) => `  ${s.name.padEnd(28)} ${s.description}`),
+    '',
+    `── Mipham Exclusive (${counts.mipham}) ──`,
+    ...mipham.map((s) => `  ${s.name.padEnd(20)} ${s.description}`),
+    '',
+    `${counts.total} skills loaded. Use Skill tool to invoke.`,
+  ]
+  return { content: lines.join('\n') }
+}
 
 // ═══════════════════════════════════════════════════════════════
 // Workflow
@@ -382,24 +398,89 @@ const todosCmd: CommandHandler = (_ctx) => ({
 // Project
 // ═══════════════════════════════════════════════════════════════
 
-const initCmd: CommandHandler = (_ctx) => ({
-  content: stripIndent`
-    ── Initialize Mipham Code ──
+const initCmd: CommandHandler = async (ctx) => {
+  const { existsSync, mkdirSync, writeFileSync } = await import('node:fs')
+  const { join } = await import('node:path')
+  const { homedir } = await import('node:os')
+
+  const home = homedir()
+  const userConfigPath = join(home, '.mipham', 'config.yml')
+
+  // Generate user-friendly config if it doesn't exist yet
+  if (!existsSync(userConfigPath)) {
+    mkdirSync(join(home, '.mipham'), { recursive: true })
+
+    const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
+    const providerYaml = activeProviders
+      .map((p) => {
+        const tips: Record<string, string> = {
+          anthropic: '# Get key: https://console.anthropic.com/',
+          openai: '# Get key: https://platform.openai.com/api-keys',
+          deepseek: '# Get key: https://platform.deepseek.com/api_keys',
+          kimi: '# Get key: https://platform.moonshot.cn/',
+          doubao: '# Get key: https://console.volcengine.com/ark',
+          hunyuan: '# Get key: https://console.cloud.tencent.com/hunyuan',
+          qwen: '# Get key: https://dashscope.console.aliyun.com/apiKey',
+          google: '# Get key: https://aistudio.google.com/apikey',
+        }
+        const comment = tips[p.id] || ''
+        const baseUrlLine = p.baseUrl ? `\n    baseUrl: "${p.baseUrl}"` : ''
+        return `  ${comment}
+  - id: ${p.id}
+    name: "${p.name}"${baseUrlLine}
+    apiKey: "\${${p.id.toUpperCase()}_API_KEY}"`
+      })
+      .join('\n\n')
+
+    const configContent = `# Mipham Code — User Configuration
+# Location: ~/.mipham/config.yml
+# Docs:     https://mipham.ai/code/docs/config
+#
+# ═══ Quick Start ═══
+# 1. Replace the API key placeholders below with your real keys
+# 2. Save the file
+# 3. Run 'mipham' — it auto-detects configured providers
+#
+# ═══ Environment Variables (Alternative) ═══
+# Instead of editing this file, you can set env vars:
+#   export ANTHROPIC_API_KEY="sk-ant-..."
+#   export OPENAI_API_KEY="sk-..."
+#   (The \${VAR} syntax below reads from environment variables)
+
+# ── Defaults ──
+defaultProvider: ${ctx.providerId}
+defaultModel: ${ctx.modelId}
+permission: ask
 
-    To initialize a project:
+# ── Providers (${activeProviders.length} pre-configured — just add your API keys) ──
+providers:
+${providerYaml}
+`
 
-    1. Create .mipham/config.yml:
-       version: "0.1.0"
-       defaultProvider: anthropic
-       defaultModel: claude-sonnet-4-6
-       permission: auto
+    writeFileSync(userConfigPath, configContent, 'utf-8')
+    return {
+      content: `✅ Mipham Code initialized!
 
-    2. Or use the Config tool:
-       Config set defaultProvider anthropic
+Created: ~/.mipham/config.yml (${activeProviders.length} providers pre-configured)
 
-    Run /config to view current configuration.
-  `,
-})
+Next steps:
+  1. Edit ~/.mipham/config.yml — replace API key placeholders with your real keys
+  2. Run mipham to start
+
+Providers configured:
+${activeProviders.map((p) => `  • ${p.name} — ${p.id.toUpperCase()}_API_KEY`).join('\n')}
+
+Tip: /setup for the full 6-step wizard.`,
+    }
+  }
+
+  // Config already exists — show status
+  return {
+    content: `~/.mipham/config.yml already exists.
+
+Run /setup for the full wizard, or /config to view current settings.`,
+  }
+}
 
 // ═══════════════════════════════════════════════════════════════
 // Phase 1 — New Session Commands
@@ -508,6 +589,83 @@ const reloadSkillsCmd: CommandHandler = (ctx) => {
   }
 }
 
+// ═══════════════════════════════════════════════════════════════
+// Skill Marketplace — Community skill registry + installation
+// ═══════════════════════════════════════════════════════════════
+
+const browseSkillsCmd: CommandHandler = async () => {
+  const { getAvailableSkills, listInstalledSkills } = await import('../skills/registry')
+  const available = getAvailableSkills()
+  const installed = new Set(
+    listInstalledSkills().map((f: string) => f.replace(/\.(SKILL\.)?md$/i, '')),
+  )
+
+  const categories = new Map<string, string[]>()
+  for (const s of available) {
+    const list = categories.get(s.category) || []
+    list.push(s.name)
+    categories.set(s.category, list)
+  }
+
+  const lines: string[] = [
+    '── Community Skills ──',
+    '',
+    `${available.length} skills available · ${installed.size} installed`,
+    '',
+  ]
+
+  for (const [cat, names] of categories) {
+    lines.push(`  ${cat}:`)
+    for (const name of names) {
+      const entry = available.find((s) => s.name === name)!
+      const marker = installed.has(name) ? '✅' : '⬜'
+      lines.push(`    ${marker} /${name.padEnd(26)} ${entry.description}`)
+    }
+    lines.push('')
+  }
+
+  lines.push('Install: /install-skill <name>')
+  lines.push('Install from URL: /install-skill <github-url>')
+  lines.push('Remove:  /remove-skill <name>')
+
+  return { content: lines.join('\n') }
+}
+
+const installSkillCmd: CommandHandler = async (_ctx, args) => {
+  const { installSkill, installSkillFromUrl } = await import('../skills/registry')
+
+  const target = args[0]
+  if (!target) {
+    return { content: 'Usage: /install-skill <skill-name> or /install-skill <url>' }
+  }
+
+  let result: { success: boolean; name: string; message: string }
+
+  if (target.startsWith('http://') || target.startsWith('https://')) {
+    result = installSkillFromUrl(target)
+  } else {
+    result = installSkill(target)
+  }
+
+  return {
+    content: result.success ? `✅ ${result.message}` : `❌ ${result.message}`,
+  }
+}
+
+const removeSkillCmd: CommandHandler = async (_ctx, args) => {
+  const { removeSkill } = await import('../skills/registry')
+
+  const name = args[0]
+  if (!name) {
+    return { content: 'Usage: /remove-skill <skill-name>' }
+  }
+
+  const result = removeSkill(name)
+  return {
+    content: result.success ? `✅ ${result.message}` : `❌ ${result.message}`,
+  }
+}
+
 // ═══════════════════════════════════════════════════════════════
 // Phase 1 — History & Checkpoint Commands
 // ═══════════════════════════════════════════════════════════════
@@ -1135,24 +1293,72 @@ const memoryCmd: CommandHandler = async () => {
 // Upgrade
 // ═══════════════════════════════════════════════════════════════
 
-const upgradeCmd: CommandHandler = () => ({
-  content: `─ Upgrade Mipham Code ─
+const upgradeCmd: CommandHandler = async () => {
+  const { checkForUpdates, backupConfig, performUpdate, restoreConfig, getConfigPath } =
+    await import('../shared/update')
 
-Current version: v0.1.0
+  const update = checkForUpdates()
 
-To upgrade:
-  curl -fsSL https://mipham.ai/install.sh | bash
+  if (!update.available) {
+    return {
+      content: `── Upgrade Mipham Code ──
 
-Or if installed via npm:
-    ${NPM_UPDATE_COMMAND}
+Current version: v${update.current}
+Latest:          v${update.latest}
 
-Release channels:
-  • stable  — recommended for most users
-  • beta    — early access to new features
-  • nightly — latest commits, may be unstable
+✓ Already up to date.
 
-Check for updates: https://mipham.ai/code/releases`,
-})
+To check manually: https://www.npmjs.com/package/@miphamai/cli`,
+    }
+  }
+
+  // Update available — back up config and perform the upgrade
+  const backupPath = backupConfig(`upgrade-v${update.current}`)
+
+  const lines: string[] = [
+    '── Upgrade Mipham Code ──',
+    '',
+    `Current version: v${update.current}`,
+    `Latest:          v${update.latest}`,
+    '',
+    `→ New version available! Updating...`,
+    '',
+  ]
+
+  if (backupPath) {
+    lines.push(`Config backed up to: ${backupPath}`)
+  }
+
+  const ok = performUpdate(update.latest)
+
+  if (ok) {
+    const configPath = getConfigPath()
+    const { existsSync } = await import('node:fs')
+    lines.push('')
+    lines.push(`✓ Updated to @miphamai/cli v${update.latest}`)
+
+    if (existsSync(configPath)) {
+      lines.push(`✓ Config preserved: ${configPath}`)
+    } else if (backupPath) {
+      if (restoreConfig(backupPath)) {
+        lines.push('✓ Config restored from backup.')
+      }
+    }
+
+    lines.push('')
+    lines.push('⚠ The running Mipham Code process is still the old version.')
+    lines.push('  Run `mipham` again to use the new version, or `mipham --version` to verify.')
+  } else {
+    lines.push('')
+    lines.push('✗ Update failed.')
+    lines.push(`  Try manually: ${NPM_UPDATE_COMMAND}`)
+    if (backupPath) {
+      lines.push(`  Your config backup is at: ${backupPath}`)
+    }
+  }
+
+  return { content: lines.join('\n') }
+}
 
 // ═══════════════════════════════════════════════════════════════
 // No-Plan — exit plan mode
@@ -1255,6 +1461,168 @@ Tool execution is sandboxed to the project directory by default.`,
   }
 }
 
+// ═══════════════════════════════════════════════════════════════
+// Recommend — analyze project and recommend setup (like Claude Code
+// automation recommender)
+// ═══════════════════════════════════════════════════════════════
+
+const recommendCmd: CommandHandler = async (ctx) => {
+  const { existsSync, readFileSync } = await import('node:fs')
+  const { join } = await import('node:path')
+  const { getAvailableSkills } = await import('../skills/registry')
+
+  const cwd = process.cwd()
+  const lines: string[] = ['── Mipham Code: Setup Recommendations ──', '', `Project: ${cwd}`, '']
+
+  // ── Detect project type ──
+  const hasPackageJson = existsSync(join(cwd, 'package.json'))
+  const hasTsConfig = existsSync(join(cwd, 'tsconfig.json'))
+  const hasPyProject = existsSync(join(cwd, 'pyproject.toml'))
+  const hasRequirements = existsSync(join(cwd, 'requirements.txt'))
+  const hasDockerfile = existsSync(join(cwd, 'Dockerfile'))
+  const hasGitHubActions = existsSync(join(cwd, '.github', 'workflows'))
+  const hasNextConfig =
+    existsSync(join(cwd, 'next.config.js')) || existsSync(join(cwd, 'next.config.ts'))
+  const hasVueConfig =
+    existsSync(join(cwd, 'vite.config.ts')) || existsSync(join(cwd, 'vite.config.js'))
+  const hasTailwind =
+    existsSync(join(cwd, 'tailwind.config.ts')) || existsSync(join(cwd, 'tailwind.config.js'))
+
+  let pkgData: Record<string, unknown> = {}
+  if (hasPackageJson) {
+    try {
+      pkgData = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf-8'))
+    } catch {
+      /* ignore */
+    }
+  }
+  const deps = {
+    ...((pkgData.dependencies as Record<string, string>) || {}),
+    ...((pkgData.devDependencies as Record<string, string>) || {}),
+  }
+  const isTypeScript = hasTsConfig || 'typescript' in deps
+  const isReact = 'react' in deps || 'next' in deps
+  const isVue = 'vue' in deps
+  const isNode = hasPackageJson
+  const isPython = hasPyProject || hasRequirements
+  const isFastAPI = 'fastapi' in deps
+  const isNextJS = 'next' in deps
+  const isExpress = 'express' in deps || 'fastify' in deps
+  const isDocker = hasDockerfile
+
+  // ── Detection summary ──
+  const tags: string[] = []
+  if (isTypeScript) tags.push('TypeScript')
+  if (isReact) tags.push('React')
+  if (isVue) tags.push('Vue')
+  if (isNextJS) tags.push('Next.js')
+  if (isExpress) tags.push('Node.js API')
+  if (isFastAPI) tags.push('FastAPI')
+  if (isPython) tags.push('Python')
+  if (isDocker) tags.push('Docker')
+  if (hasTailwind) tags.push('Tailwind CSS')
+  if (hasGitHubActions) tags.push('CI/CD')
+
+  lines.push('── Detected Stack ──')
+  lines.push('')
+  if (tags.length > 0) {
+    lines.push(`  ${tags.join(' · ')}`)
+  } else {
+    lines.push('  (generic project — no specific framework detected)')
+  }
+  lines.push('')
+
+  // ── Skill recommendations ──
+  const communitySkills = getAvailableSkills()
+  const recommendedSkills: string[] = []
+
+  // Always useful
+  recommendedSkills.push('code-review')
+  recommendedSkills.push('systematic-debugging')
+
+  if (isTypeScript || isNode) {
+    recommendedSkills.push('github-ops')
+  }
+  if (isReact || isVue || isNextJS) {
+    recommendedSkills.push('frontend-design')
+  }
+  if (hasGitHubActions) {
+    recommendedSkills.push('security-review')
+  }
+  if (isPython) {
+    recommendedSkills.push('doc-generator')
+  }
+
+  // Filter to only those in the registry
+  const available = recommendedSkills.filter((name) => communitySkills.some((s) => s.name === name))
+
+  lines.push('── Recommended Skills ──')
+  lines.push('')
+  if (available.length > 0) {
+    for (const name of available) {
+      const entry = communitySkills.find((s) => s.name === name)!
+      lines.push(`  /install-skill ${name.padEnd(26)} ${entry.description}`)
+    }
+  }
+  lines.push('  /browse-skills           Browse all community skills')
+  lines.push('')
+
+  // ── Provider recommendations ──
+  const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
+  const configured = activeProviders.filter((p) => p.apiKey && p.apiKey.trim() !== '')
+
+  lines.push('── Provider Status ──')
+  lines.push('')
+  if (configured.length === 0) {
+    lines.push('  ⚠ No providers have API keys configured.')
+    lines.push('  Run /setup 2 to configure providers.')
+    lines.push('')
+    lines.push('  Recommended for this project:')
+    if (isTypeScript || isNode || isReact) {
+      lines.push('    • anthropic — Claude (code generation, review)')
+      lines.push('    • openai   — GPT-5 (general purpose)')
+    }
+    if (isPython) {
+      lines.push('    • anthropic — Claude (data science, ML)')
+    }
+  } else {
+    lines.push(`  ${configured.length}/${activeProviders.length} providers configured`)
+    for (const p of configured) {
+      lines.push(`    ✅ ${p.id.padEnd(14)} ${p.name}`)
+    }
+  }
+  lines.push('')
+
+  // ── Config recommendations ──
+  lines.push('── Configuration Tips ──')
+  lines.push('')
+
+  const hasProjectMipham = existsSync(join(cwd, '.mipham'))
+  if (!hasProjectMipham) {
+    lines.push('  /setup 1     Initialize .mipham/ + MIPHAM.md + config.yml')
+  }
+
+  const { listInstalledSkills } = await import('../skills/registry')
+  const installed = listInstalledSkills()
+  if (installed.length === 0 && available.length > 0) {
+    lines.push('  Tip:         Install recommended skills above for better AI assistance')
+  }
+
+  if (isDocker && !hasProjectMipham) {
+    lines.push('  Tip:         Add .mipham/ to .dockerignore for smaller images')
+  }
+
+  if (hasGitHubActions) {
+    lines.push('  /setup 5     Configure tool permissions for CI/CD safety')
+  }
+
+  lines.push('  /setup       Full setup wizard (6 steps)')
+  lines.push('  /help        All commands')
+  lines.push('')
+
+  return { content: lines.join('\n') }
+}
+
 // ═══════════════════════════════════════════════════════════════
 // Setup — guided project initialization (mirrors Claude Code /setup)
 // ═══════════════════════════════════════════════════════════════
@@ -1356,17 +1724,60 @@ async function setupStep1(ctx: CommandContext): Promise<CommandResult> {
 
   // Create project config if missing
   if (!existsSync(configPath)) {
-    const defaultConfig = `# Mipham Code — Project Configuration
-# See https://mipham.ai/code/docs/config for all options
-
+    // Generate a user-friendly config with all providers pre-populated.
+    // Users just need to replace the API key placeholders with their real keys.
+    const activeProviders = ctx.config.providers.filter((p) => p.status === 'active')
+    const providerYaml = activeProviders
+      .map((p) => {
+        const comment =
+          p.id === 'anthropic'
+            ? '# Get key: https://console.anthropic.com/'
+            : p.id === 'openai'
+              ? '# Get key: https://platform.openai.com/api-keys'
+              : p.id === 'deepseek'
+                ? '# Get key: https://platform.deepseek.com/api_keys'
+                : p.id === 'kimi'
+                  ? '# Get key: https://platform.moonshot.cn/'
+                  : p.id === 'doubao'
+                    ? '# Get key: https://console.volcengine.com/ark'
+                    : p.id === 'hunyuan'
+                      ? '# Get key: https://console.cloud.tencent.com/hunyuan'
+                      : p.id === 'qwen'
+                        ? '# Get key: https://dashscope.console.aliyun.com/apiKey'
+                        : p.id === 'google'
+                          ? '# Get key: https://aistudio.google.com/apikey'
+                          : ''
+        const baseUrlLine = p.baseUrl ? `\n    baseUrl: "${p.baseUrl}"` : ''
+        return `  ${comment}
+  - id: ${p.id}
+    name: "${p.name}"${baseUrlLine}
+    apiKey: "\${${p.id.toUpperCase()}_API_KEY}"`
+      })
+      .join('\n\n')
+
+    const defaultConfig = `# Mipham Code — User Configuration
+# Location: ~/.mipham/config.yml
+# Docs:     https://mipham.ai/code/docs/config
+#
+# ═══ Quick Start ═══
+# 1. Set your API keys below (replace the placeholder values)
+# 2. Save the file
+# 3. Run 'mipham' — it auto-detects configured providers
+#
+# ═══ Environment Variables ═══
+# Instead of editing this file, you can set env vars:
+#   export ANTHROPIC_API_KEY="sk-ant-..."
+#   export OPENAI_API_KEY="sk-..."
+#   (The \${VAR} syntax below reads from environment variables)
+
+# ── Defaults ──
 defaultProvider: ${ctx.providerId}
 defaultModel: ${ctx.modelId}
 permission: ask
 
-# Uncomment to add project-specific providers:
-# providers:
-#   - id: anthropic
-#     apiKey: \$ANTHROPIC_API_KEY
+# ── Providers (8 configured, just add your API keys) ──
+providers:
+${providerYaml}
 `
     writeFileSync(configPath, defaultConfig, 'utf-8')
     created.push('.mipham/config.yml')
@@ -1500,16 +1911,19 @@ async function setupStep3(ctx: CommandContext): Promise<CommandResult> {
   return { content: lines.join('\n') }
 }
 
-async function setupStep4(_ctx: CommandContext): Promise<CommandResult> {
+async function setupStep4(ctx: CommandContext): Promise<CommandResult> {
+  const counts = ctx.skillsLoader?.countByType() ?? { standard: 0, mipham: 0, total: 0 }
+  const standardNames = ctx.skillsLoader?.getNamesByType('standard') ?? []
+  const miphamNames = ctx.skillsLoader?.getNamesByType('mipham') ?? []
+
   return {
     content: `── Step 4: Install Skills ──
 
 Skills extend Mipham Code with specialized capabilities.
 
-Built-in skills (11 total):
-  Standard (9):  code-review, compassionate-communication, doc-generator,
-                 github-ops, memory, self-review, superpower, tdd, web-search
-  Mipham (2):    om-model-optimize, om-security
+Built-in skills (${counts.total} total):
+  Standard (${counts.standard}):  ${standardNames.join(', ')}
+  Mipham (${counts.mipham}):    ${miphamNames.join(', ')}
 
 Community skills:
   Coming soon — the Mipham Code skills marketplace will let you
@@ -1705,6 +2119,7 @@ const securityCmd: CommandHandler = async () => {
   }
 
   // 2. Check for hardcoded secrets (quick grep for common patterns)
+  // ⚠ Security: results are redacted — only file:line locations are shown, never values
   try {
     const { execSync } = await import('node:child_process')
     const secretPatterns = execSync(
@@ -1712,11 +2127,20 @@ const securityCmd: CommandHandler = async () => {
       { encoding: 'utf-8', timeout: 5000 },
     ).trim()
     if (secretPatterns) {
+      // Redact the actual values — only show file:line locations
+      const redacted = secretPatterns
+        .split('\n')
+        .map((l) => {
+          const colonIdx = l.indexOf(':')
+          const secondColon = l.indexOf(':', colonIdx + 1)
+          if (secondColon > 0) {
+            return '    ' + l.slice(0, secondColon) + ' [VALUE REDACTED]'
+          }
+          return '    ' + l + ' [REDACTED]'
+        })
+        .join('\n')
       findings.push(
-        `Possible hardcoded secrets found:\n${secretPatterns
-          .split('\n')
-          .map((l) => '    ' + l)
-          .join('\n')}`,
+        `⚠ Hardcoded secrets detected (values redacted for security):\n${redacted}\n\n  Replace with env vars: \${VAR_NAME} syntax`,
       )
     } else {
       ok.push('No hardcoded secrets detected')
@@ -2273,6 +2697,118 @@ const artifactBaseCmd: CommandHandler = (ctx, args) => {
 // Remaining low-priority stubs (backend not yet available)
 // ═══════════════════════════════════════════════════════════════
 
+// ═══════════════════════════════════════════════════════════════
+// Commands — list all registered slash commands
+// ═══════════════════════════════════════════════════════════════
+
+const commandsListCmd: CommandHandler = () => {
+  const names = getCommandNames()
+  const categories: Record<string, string[]> = {
+    'Session & Identity': [],
+    History: [],
+    'Model & Provider': [],
+    'Tools & Skills': [],
+    Workflow: [],
+    Project: [],
+    Environment: [],
+    Account: [],
+    Agents: [],
+    Artifacts: [],
+    Other: [],
+  }
+
+  const catMap: Record<string, string> = {
+    '/help': 'Session & Identity',
+    '/version': 'Session & Identity',
+    '/clear': 'Session & Identity',
+    '/exit': 'Session & Identity',
+    '/quit': 'Session & Identity',
+    '/compact': 'Session & Identity',
+    '/context': 'Session & Identity',
+    '/status': 'Session & Identity',
+    '/cost': 'Session & Identity',
+    '/usage': 'Session & Identity',
+    '/rename': 'Session & Identity',
+    '/goal': 'Session & Identity',
+    '/recap': 'Session & Identity',
+    '/export': 'Session & Identity',
+    '/doctor': 'Session & Identity',
+    '/resume': 'Session & Identity',
+    '/branch': 'Session & Identity',
+    '/rewind': 'History',
+    '/undo': 'History',
+    '/copy': 'History',
+    '/focus': 'History',
+    '/pick': 'Model & Provider',
+    '/model': 'Model & Provider',
+    '/models': 'Model & Provider',
+    '/provider': 'Model & Provider',
+    '/providers': 'Model & Provider',
+    '/switch': 'Model & Provider',
+    '/config': 'Model & Provider',
+    '/fast': 'Model & Provider',
+    '/effort': 'Model & Provider',
+    '/theme': 'Model & Provider',
+    '/upgrade': 'Model & Provider',
+    '/tools': 'Tools & Skills',
+    '/skills': 'Tools & Skills',
+    '/reload-skills': 'Tools & Skills',
+    '/browse-skills': 'Tools & Skills',
+    '/install-skill': 'Tools & Skills',
+    '/remove-skill': 'Tools & Skills',
+    '/mcp': 'Tools & Skills',
+    '/commands': 'Tools & Skills',
+    '/plan': 'Workflow',
+    '/no-plan': 'Workflow',
+    '/tdd': 'Workflow',
+    '/todos': 'Workflow',
+    '/tasks': 'Workflow',
+    '/review': 'Workflow',
+    '/pr-comments': 'Workflow',
+    '/diff': 'Workflow',
+    '/workflows': 'Workflow',
+    '/loop': 'Workflow',
+    '/init': 'Project',
+    '/setup': 'Project',
+    '/permissions': 'Project',
+    '/add-dir': 'Project',
+    '/recommend': 'Project',
+    '/security': 'Project',
+    '/audit': 'Project',
+    '/ide': 'Environment',
+    '/terminal-setup': 'Environment',
+    '/memory': 'Environment',
+    '/release-notes': 'Environment',
+    '/login': 'Account',
+    '/logout': 'Account',
+    '/feedback': 'Account',
+    '/agents': 'Agents',
+    '/bg': 'Agents',
+    '/artifact': 'Artifacts',
+    '/schedule': 'Other',
+  }
+
+  for (const name of names) {
+    const cat = catMap[name] ?? 'Other'
+    categories[cat]?.push(name)
+  }
+
+  const lines: string[] = [`── All Slash Commands (${names.length}) ──`, '']
+
+  for (const [cat, cmds] of Object.entries(categories)) {
+    if (cmds.length === 0) continue
+    lines.push(`── ${cat} (${cmds.length}) ──`)
+    for (const c of cmds) {
+      lines.push(`  ${c}`)
+    }
+    lines.push('')
+  }
+
+  lines.push('Type /help for details, or /<command> to run.')
+
+  return { content: lines.join('\n') }
+}
+
 // ═══════════════════════════════════════════════════════════════
 // Command Registry
 // ═══════════════════════════════════════════════════════════════
@@ -2314,6 +2850,10 @@ registry.set('/effort', effortCmd)
 registry.set('/tools', toolsCmd)
 registry.set('/skills', skillsCmd)
 registry.set('/reload-skills', reloadSkillsCmd)
+registry.set('/browse-skills', browseSkillsCmd)
+registry.set('/install-skill', installSkillCmd)
+registry.set('/remove-skill', removeSkillCmd)
+registry.set('/commands', commandsListCmd)
 
 // Workflow
 registry.set('/plan', planCmd)
@@ -2337,6 +2877,7 @@ registry.set('/upgrade', upgradeCmd)
 // Project
 registry.set('/init', initCmd)
 registry.set('/setup', setupCmd)
+registry.set('/recommend', recommendCmd)
 registry.set('/permissions', permissionsCmd)
 registry.set('/add-dir', addDirCmd)
 registry.set('/security', securityCmd)
@@ -2375,6 +2916,89 @@ export function getCommandNames(): string[] {
   return Array.from(registry.keys()).sort()
 }
 
+export interface CommandEntry {
+  name: string
+  description: string
+}
+
+const COMMAND_DESCRIPTIONS: Record<string, string> = {
+  '/help': 'Show help',
+  '/commands': 'List all slash commands',
+  '/version': 'Show version info',
+  '/clear': 'Clear conversation',
+  '/exit': 'Exit Mipham Code',
+  '/quit': 'Exit Mipham Code',
+  '/compact': 'Compact context window',
+  '/context': 'Show context stats',
+  '/status': 'Session and system status',
+  '/cost': 'Token usage estimate',
+  '/usage': 'Detailed usage dashboard',
+  '/rename': 'Rename current session',
+  '/goal': 'Set session goal',
+  '/recap': 'Summarize session so far',
+  '/export': 'Export conversation to file',
+  '/doctor': 'System diagnostics',
+  '/resume': 'List saved sessions',
+  '/branch': 'Fork conversation',
+  '/rewind': 'Undo last AI turn',
+  '/undo': 'Same as /rewind',
+  '/copy': 'Copy last response to clipboard',
+  '/focus': 'Toggle focus view',
+  '/pick': 'Open model picker',
+  '/model': 'Show current model',
+  '/models': 'List all available models',
+  '/provider': 'Show current provider',
+  '/providers': 'List configured providers',
+  '/switch': 'Switch provider and model',
+  '/config': 'View configuration',
+  '/fast': 'Toggle fast mode',
+  '/effort': 'Set reasoning effort',
+  '/theme': 'Set terminal theme',
+  '/tools': 'List available tools',
+  '/skills': 'List loaded skills',
+  '/reload-skills': 'Reload all skills',
+  '/browse-skills': 'Browse community skill marketplace',
+  '/install-skill': 'Install a skill by name or URL',
+  '/remove-skill': 'Remove an installed skill',
+  '/mcp': 'MCP server status',
+  '/plan': 'Enter plan mode',
+  '/no-plan': 'Exit plan mode',
+  '/tdd': 'TDD mode',
+  '/todos': 'Task management',
+  '/tasks': 'Background tasks',
+  '/review': 'Code review workflow',
+  '/pr-comments': 'PR review summary',
+  '/diff': 'Show git diff',
+  '/workflows': 'List workflow scripts',
+  '/loop': 'Run prompt on interval',
+  '/init': 'Initialize .mipham config',
+  '/setup': 'Guided project setup wizard',
+  '/permissions': 'Show permission settings',
+  '/add-dir': 'Add workspace directory',
+  '/recommend': 'Analyze project + recommend skills & setup',
+  '/security': 'Security review checklist',
+  '/audit': 'Same as /security',
+  '/ide': 'IDE integration guide',
+  '/terminal-setup': 'Shell & terminal config',
+  '/memory': 'Manage AI memories',
+  '/release-notes': 'View version changelog',
+  '/upgrade': 'Show upgrade instructions',
+  '/login': 'Show API key status',
+  '/logout': 'Clear credentials guide',
+  '/feedback': 'Send feedback',
+  '/agents': 'Agent view dashboard',
+  '/bg': 'Run a background agent task',
+  '/artifact': 'Manage artifacts',
+  '/schedule': 'View scheduled tasks',
+}
+
+export function getCommandList(): CommandEntry[] {
+  return getCommandNames().map((name) => ({
+    name,
+    description: COMMAND_DESCRIPTIONS[name] ?? '',
+  }))
+}
+
 export function looksLikeSlashCommand(input: string): boolean {
   return input.trim().startsWith('/')
 }