feat(cli): support slash commands from installed plugins

[Fdcode6]

This PR adds support for slash commands provided by installed plugins (e.g. Claude plugins). It automatically scans the ~/.claude/plugins/installed_plugins.json file, registers commands with their plugin namespace prefix, and ensures the web UI correctly renders them. Verified working with the superpowers plugin.

[github-actions]

[MAJOR] Type union missing plugin

Why this is a problem: cmd.source === 'plugin' now relies on a source variant that is not in SlashCommand.source, which makes this condition invalid under TS strict and will fail typecheck.

Suggested fix:

export type SlashCommand = {
    name: string
    description?: string
    source: 'builtin' | 'user' | 'plugin'
    content?: string  // Expanded content for Codex user prompts
    pluginName?: string
}

[github-actions]

Findings

• [Major] Web SlashCommand type missing plugin variant; new filter compares against plugin and will fail TS strict unless the union is updated. Evidence web/src/hooks/queries/useSlashCommands.ts:90, web/src/types/api.ts:138.
  Suggested fix:

  export type SlashCommand = {
      name: string
      description?: string
      source: 'builtin' | 'user' | 'plugin'
      content?: string  // Expanded content for Codex user prompts
      pluginName?: string
  }

Summary

• 1 major issue; type mismatch in web API types

Testing

• Not run (automation); suggest bun typecheck

[tiann]

@tiann review again

[github-actions]

Review again — findings.

• Scoped plugin name bug risk: pluginKey.split('@')[0] drops leading scope (@org/plugin@marketplace => empty), producing :command and "undefined command" description. Prefer last @ split or handle leading @. cli/src/modules/common/slashCommands.ts:195-203, cli/src/modules/common/slashCommands.ts:121-141
• Multiple installs ignored: installations[0] picked without scope/recency selection; could point at stale install. Consider choosing by scope or newest lastUpdated. cli/src/modules/common/slashCommands.ts:194-203

Question: actual installed_plugins.json key format for plugin names? If scoped, need adjust parsing.

---

HAPI Bot