@pellux/goodvibes-tui 0.18.20 → 0.19.0

package/CHANGELOG.md

@@ -4,6 +4,160 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [0.19.0] — 2026-04-18
+
+### Changed
+- Upgraded `@pellux/goodvibes-sdk` from 0.19.6 to 0.21.1 (soak-period release).
+  TUI adaptation required: regenerated `docs/foundation-artifacts/operator-contract.json`
+  to match the updated `buildOperatorContract()` output in the new SDK version.
+  `peer-contract.json`, `knowledge-graphql.graphql`, and `knowledge-store.sql` were
+  unchanged by this SDK bump.
+
+### Added
+- Wave B panel migration: migrated 5 panels (knowledge, marketplace, memory,
+  system-messages, orchestration) to `ScrollableListPanel<T>`/`SearchableListPanel<T>`
+  generics; added `docs/panel-authoring.md` as the canonical panel authoring guide.
+- Wave C-α reliability pass: F-perf-01 (trackedRender on 5 hot panels),
+  F-perf-02 (async panel fs + skills-panel de-blocking), F-perf-03 (timer registry
+  + 5-panel zombie-timer leak prevention), F-errors-02 (observable async failures —
+  no silent `.catch(() => {})`), F-sec-02 (ANSI escape sanitization at
+  tool-call untrusted-content entry points).
+- `src/input/settings-modal-types.ts`: extracted `SettingsCategory`,
+  `SETTINGS_CATEGORIES`, `SettingEntry`, `FlagEntry`, `McpEntry`,
+  `SubscriptionEntry` type definitions out of the settings-modal module.
+
+### Security
+- Postinstall patcher from `@pellux/goodvibes-sdk@0.21.1` mitigates three
+  minimatch ReDoS advisories in the consumer install tree.
+- Added `overrides: { minimatch: ^10.2.5 }` to TUI's own `package.json`
+  so `npm audit` reports clean for the TUI install tree independently.
+
+### Fixed
+- Foundation artifacts gate now passes: `operator-contract.json` updated to
+  match SDK 0.21.1 `buildOperatorContract()` canonical output.
+
+---
+
+## [0.18.23] — 2026-04-16
+
+### Wave 4α+β performance bundle + α review follow-ups + regression fixes
+
+Bundles Wave 4α (conversation-rendering double-parse elimination) and Wave 4β
+(feed-context object reuse) into a single release, adds documentation and test
+follow-ups from the 4α review, and fixes two regressions surfaced during that
+review.
+
+### Performance (Wave 4α — conversation-rendering)
+
+- **`src/core/conversation-rendering.ts`** — eliminates the legacy `renderMarkdown()`
+  duplicate call used for `'code'` mode line counting. The 'all' mode retain its
+  intentional measurement pass (see inline comment for rationale); the 'code' mode
+  now derives its gutter width from the single `renderMarkdownTracked()` call.
+
+### Performance (Wave 4β — feed-context object reuse)
+
+- **`src/input/handler.ts`** — `InputHandler` now allocates a single `InputFeedContext`
+  at startup (`initFeedContext()`) and mutates only the 14 mutable fields before
+  each `feedInputTokens()` call via `syncFeedContextMutableFields()`. Stable service
+  handles, closures, and callbacks are wired once and never re-assigned. Eliminates
+  per-keystroke allocations on the hot input path.
+- **`src/input/feed-context-factory.ts`** (new) — extracts `buildInitialFeedContext()`
+  and the `FeedContextMutableInit` / `FeedContextStableRefs` / `FeedContextClosures`
+  interfaces out of `handler.ts` to keep `handler.ts` under the 800-line architecture
+  cap.
+
+### Regression fixes
+
+- **R1 — `handler.ts` architecture cap** — `handler.ts` was 830 lines after Wave 4β.
+  Extracted factory functions into `src/input/feed-context-factory.ts`; `handler.ts`
+  is now exactly 800 lines. `bun run architecture:check` passes.
+- **R2 — `SearchableListPanel.buildFilterInputLine` cursor glyph** — the focused
+  filter line (`[Label] query_`) was rendering the trailing `_` as the block cursor
+  glyph `█` because `buildSearchInputLine` substitutes `_` → `█` when `active:true`.
+  Fixed by passing `active:false` with explicit `inputBg`/`info` colors; the
+  `[Label] ` bracket format provides the focused visual affordance without triggering
+  the substitution. Fixes the pre-existing test failure from 0.18.22.
+
+### Quality bumps (Wave 4α review follow-ups)
+
+- **F1** — `src/test/input/feed-context-reuse.test.ts`: added mutable-field assertion
+  verifying `ctx.prompt` and `ctx.cursorPos` update between feeds (feeds 'a' → 'b',
+  asserts accumulated mutation).
+- **F2** — `src/test/input/keybinding-lookup.test.ts`: replaced no-op reload test
+  with a real temp-file config override (remaps `search` → Ctrl+G, verifies Ctrl+F
+  returns null); added a second test for conflicting bindings (two actions mapped to
+  same combo resolves to one of them, not null).
+- **F3** — `src/input/handler-feed.ts`: added JSDoc to `InputFeedContext` interface
+  documenting all mutable-per-feed fields vs. stable service handles and explaining
+  the reuse rationale.
+- **F4** — `src/input/feed-context-factory.ts`: `syncFeedContextMutableFields()` has
+  full JSDoc listing every synced field and documenting intentional exclusions.
+- **F5** — `src/core/conversation-rendering.ts`: added inline comment block explaining
+  why 'all' mode requires a double-call to `renderMarkdownTracked` (Option B) and
+  why single-pass is not feasible.
+
+---
+
+## [0.18.22] — 2026-04-16
+
+### Wave 3b / Tier 2 TUI UX Consistency — Panel Migration Batch
+
+Migrates 7 more BasePanel-direct panels to `ScrollableListPanel<T>`, restores
+section-title text lost during prior migrations, and fixes 8 pre-existing test regressions.
+
+### Migrated panels
+
+- **`src/panels/hooks-panel.ts`** — `HooksPanel` → `ScrollableListPanel<HookEntry>`.
+  Contracts/chains/managed/file stats in `header`; selected hook detail, activity (with `Recent Activity` label), authoring (with `Authoring` label) in `footer`. Empty state shows extra context via `header` parameter.
+- **`src/panels/mcp-panel.ts`** — `McpPanel` → `ScrollableListPanel<McpServerSecurityEntry>`.
+  Derived type via `ReturnType<McpRegistry['listServerSecurity']>[number]` since no named export exists.
+  `MCP posture` label + stats + guidance in `header`; selected server detail, repair actions, decision log in `footer`.
+- **`src/panels/approval-panel.ts`** — `ApprovalPanel` → `ScrollableListPanel<ApprovalRow>`.
+  `Approval posture` label + approval counts + guidance + `Selected Lane` label + detail in `header`; nav hint in `footer`.
+- **`src/panels/security-panel.ts`** — `SecurityPanel` → `ScrollableListPanel<TokenAuditResult>`.
+  Governance + threat lines in `header`; selected detail + attack path findings in `footer`.
+- **`src/panels/services-panel.ts`** — `ServicesPanel` → `ScrollableListPanel<ServicePanelEntry>`.
+  `r` (refresh) and `t` (test selected) key overrides preserved; loading state handled via early return.
+- **`src/panels/subscription-panel.ts`** — `SubscriptionPanel` → `ScrollableListPanel<SubscriptionRow>`.
+  Fully overrides `handleInput` (uses `ArrowUp`/`ArrowDown`); logout confirm state preserved; empty state uses direct `buildPanelWorkspace` path.
+- **`src/panels/tasks-panel.ts`** — `TasksPanel` → `ScrollableListPanel<RuntimeTask>`.
+  `!readModel` early-exit preserved; `buildSummaryBlock` in `header`, `buildDetailBlock` in `footer`.
+- **`src/panels/incident-review-panel.ts`** — `IncidentReviewPanel` → `ScrollableListPanel<FailureReport>`.
+  `Action Rail` label added before action guidance lines in `footer`.
+- **`src/panels/communication-panel.ts`** — `CommunicationPanel` → `ScrollableListPanel<CommunicationRecord>`.
+  `Communication posture` label added to both posture line arrays (empty + populated states).
+
+### Panels kept as BasePanel
+
+- `PolicyPanel`, `RemotePanel`, `ProviderHealthPanel`, `PanelListPanel`, `OrchestrationPanel`,
+  `MarketplacePanel`, `SchedulePanel`, `MemoryPanel`, `KnowledgePanel`, `SkillsPanel`,
+  `SessionBrowserPanel` — all use `resolveScrollablePanelSection`, multi-line-per-item render,
+  dual-mode browsing, `setInterval`, or `canRenderNow()` / `reportRenderDuration()` patterns
+  incompatible with `ScrollableListPanel<T>`.
+
+### Test fixes
+
+Restored section-title strings (`'Approval posture'`, `'Communication posture'`, `'MCP posture'`,
+`'Action Rail'`, `'Recent Activity'`, `'Selected Lane'`) dropped during migration, fixing 8
+regressions across `approval-panel`, `communication-panel`, `hooks-panel`, `mcp-panel`, and
+`incident-review-panel` test files.
+
+---
+
+## [0.18.21] — 2026-04-16
+
+### Wave 3a / Tier 2 TUI UX Consistency Infrastructure — I5
+
+Final item from Wave 3a: selection gutter and filter input UX consistency across list panels.
+
+### I5 — Selection gutter + filter input label conventions
+
+- **`src/panels/scrollable-list-panel.ts`** — `ScrollableListPanel`: added opt-in `protected showSelectionGutter = false`. When enabled, `renderList()` post-processes each item line to prepend a 2-column left gutter: `▸ ` (info color, bold) for the selected row, `  ` for all others. Line width is preserved by dropping the last 2 cells. Default off to avoid breaking panels with custom selection indicators.
+- **`src/panels/scrollable-list-panel.ts`** — `SearchableListPanel`: added `protected buildFilterInputLine(width, label, focused)`. Renders the filter line with context-sensitive label formatting: `[Filter] query_` when `focused=true` (active, bold, cursor visible), `Filter: query` when `focused=false` (dim, no cursor). Delegates to `buildSearchInputLine` from `polish.ts`.
+- **New test file `src/test/panels/scrollable-list-panel-i5.test.ts`**: 13 tests covering gutter on/off, column position of `▸`, line-width preservation, and filter label format in both focused/unfocused states.
+
+---
+
 ## [0.18.20] — 2026-04-16
 
 ### Wave 3a / Tier 2 TUI UX Consistency Infrastructure

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-0.18.20-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-0.19.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 

package/docs/foundation-artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "0.18.37"
+    "version": "0.21.1"
   },
   "auth": {
     "modes": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "0.18.20",
+  "version": "0.19.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -89,7 +89,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.18.37",
+    "@pellux/goodvibes-sdk": "0.21.1",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",
@@ -115,8 +115,12 @@
     "typescript": "^5.9.3"
   },
   "trustedDependencies": [
+    "@pellux/goodvibes-sdk",
     "tree-sitter-css",
     "tree-sitter-javascript",
     "tree-sitter-python"
-  ]
+  ],
+  "overrides": {
+    "minimatch": "^10.2.5"
+  }
 }

package/src/core/conversation-rendering.ts

@@ -1,5 +1,5 @@
 import { UIFactory } from '../renderer/ui-factory.ts';
-import { renderMarkdown, renderMarkdownTracked } from '../renderer/markdown.ts';
+import { renderMarkdownTracked } from '../renderer/markdown.ts';
 import { renderToolCallBlock } from '../renderer/tool-call.ts';
 import { renderThinkingBlock } from '../renderer/thinking.ts';
 import { renderSystemMessage } from '../renderer/system-message.ts';
@@ -102,10 +102,26 @@ export function renderConversationAssistantMessage(
   if (message.content) {
     const showAllLineNumbers = lineNumberMode === 'all';
     const showCodeBlockLineNumbers = lineNumberMode === 'all' ? false : lineNumberMode === 'code';
-    const preRendered = showAllLineNumbers
-      ? renderMarkdown(message.content, width, { codeBlockLineNumbers: false })
-      : null;
-    const totalLines = preRendered?.length ?? 0;
+    // First pass: measure totalLines for gutter sizing (only when line-numbers='all').
+    // When line numbers are off, skip the measurement pass entirely.
+    //
+    // NOTE: The 'all' mode intentionally calls renderMarkdownTracked twice:
+    //   1. Measure pass: render at full `width` to get the total line count, which
+    //      determines `numWidth` (digit count) and thus `gutterW` (gutter column width).
+    //   2. Render pass: render at `width - gutterW` with the gutter factored in.
+    //
+    // Single-pass is not pursued here. It would require either a pessimistic
+    // `numWidth=6` (fits 999,999 lines, but wastes 3-4 gutter columns on typical
+    // messages) or rendering the numbered output into a scratch buffer and trimming.
+    // Neither is clearly better than the current two-pass measurement approach.
+    // The 4α commit message claim that this "eliminates double-parse when line
+    // numbers are enabled" was inaccurate: 4α eliminated the legacy
+    // `renderMarkdown()` duplicate used for code-block line-number mode ('code').
+    // The 'all' mode double-call is a deliberate design choice and remains unchanged.
+    const measureWidth = showAllLineNumbers ? width : 0;
+    const totalLines = showAllLineNumbers
+      ? renderMarkdownTracked(message.content, measureWidth, { codeBlockLineNumbers: false }).lines.length
+      : 0;
     const numWidth = Math.max(3, String(totalLines).length);
     const gutterW = numWidth + 3;
     const contentWidth = showAllLineNumbers ? width - gutterW : width;
@@ -239,7 +255,7 @@ export function renderConversationToolMessage(
         // Leave invalid JSON as-is.
       }
     }
-    context.history.addLines(renderMarkdown(contentToRender, width));
+    context.history.addLines(renderMarkdownTracked(contentToRender, width).lines);
   }
 
   const renderedLineCount = context.history.getLineCount() - startLine;

package/src/core/orchestrator.ts

@@ -1,3 +1,3 @@
 // Thin TUI wrapper — re-exports the SDK Orchestrator unchanged.
 // The SDK class already contains all behaviour including getSpinner().
-export { Orchestrator } from '@pellux/goodvibes-sdk/platform/core/orchestrator';
+export { Orchestrator, type OrchestratorOptions } from '@pellux/goodvibes-sdk/platform/core/orchestrator';

package/src/input/commands/diff-runtime.ts

@@ -1,4 +1,5 @@
 import { join } from 'path';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
 import type { CommandRegistry } from '../command-registry.ts';
 import { requirePanelManager, requireSessionChangeTracker, requireShellPaths } from './runtime-services.ts';
 
@@ -86,7 +87,7 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
             return (await new Response(proc.stdout).text()).trim().split('\n').filter(Boolean);
           })();
           if (workingChangedFiles.length > 0) {
-            enrichSemanticDiff(diffPanel, workingChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch(() => {});
+            enrichSemanticDiff(diffPanel, workingChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
           }
           break;
         }
@@ -111,7 +112,7 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
               return (await new Response(stagedProc.stdout).text()).trim().split('\n').filter(Boolean);
             })();
             if (stagedChangedFiles.length > 0) {
-              enrichSemanticDiff(diffPanel, stagedChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch(() => {});
+              enrichSemanticDiff(diffPanel, stagedChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
             }
           }
           break;
@@ -126,7 +127,7 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
             return (await new Response(proc.stdout).text()).trim().split('\n').filter(Boolean);
           })();
           if (headChangedFiles.length > 0) {
-            enrichSemanticDiff(diffPanel, headChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch(() => {});
+            enrichSemanticDiff(diffPanel, headChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
           }
           break;
         }
@@ -137,7 +138,7 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
             ctx.print(`Loading session diff (${sessionFiles.length} file${sessionFiles.length === 1 ? '' : 's'} changed this session)...`);
             await diffPanel.showFileDiffs(sessionFiles, 'HEAD');
             ctx.print(`Diff panel updated: ${sessionFiles.length} session file${sessionFiles.length === 1 ? '' : 's'}.`);
-            enrichSemanticDiff(diffPanel, sessionFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch(() => {});
+            enrichSemanticDiff(diffPanel, sessionFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
           } else {
             ctx.print('No session changes tracked yet. Showing diff vs HEAD...');
             await diffPanel.showGitDiff('HEAD');
@@ -148,7 +149,7 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
               return (await new Response(proc.stdout).text()).trim().split('\n').filter(Boolean);
             })();
             if (fallbackFiles.length > 0) {
-              enrichSemanticDiff(diffPanel, fallbackFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch(() => {});
+              enrichSemanticDiff(diffPanel, fallbackFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
             }
           }
           break;

package/src/input/commands/guidance-runtime.ts

@@ -64,7 +64,7 @@ export function registerGuidanceRuntimeCommands(registry: CommandRegistry): void
       }
 
       const providerApi = requireProviderApi(ctx);
-      const currentModel = await providerApi.getCurrentModel().catch(() => null);
+      const currentModel = await providerApi.getCurrentModel().catch(() => null); // best-effort: null handled as unknown context window
       const llmMessages = ctx.session.conversationManager.getMessagesForLLM();
       const readModels = requireReadModels(ctx);
       const session = readModels.session.getSnapshot();

package/src/input/commands/health-runtime.ts

@@ -240,7 +240,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
       if (sub === 'maintenance') {
         const session = readModels.session.getSnapshot();
         const providerApi = requireProviderApi(ctx);
-        const currentModel = await providerApi.getCurrentModel().catch(() => null);
+        const currentModel = await providerApi.getCurrentModel().catch(() => null); // best-effort: null handled as unknown context window
         const llmMessages = typeof ctx.session.conversationManager.getMessagesForLLM === 'function'
           ? ctx.session.conversationManager.getMessagesForLLM()
           : [];
@@ -369,7 +369,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
 
       const session = readModels.session.getSnapshot();
       const providerApi = requireProviderApi(ctx);
-      const currentModel = await providerApi.getCurrentModel().catch(() => null);
+      const currentModel = await providerApi.getCurrentModel().catch(() => null); // best-effort: null handled as unknown context window
       const llmMessages = typeof ctx.session.conversationManager.getMessagesForLLM === 'function'
         ? ctx.session.conversationManager.getMessagesForLLM()
         : [];

package/src/input/commands/local-setup-review.ts

@@ -22,7 +22,7 @@ export async function buildSetupReviewSnapshot(ctx: CommandContext): Promise<Set
     }
   }
 
-  const skills = discoverSkills(shellPaths);
+  const skills = await discoverSkills(shellPaths);
   const security = requireReadModels(ctx).security.getSnapshot();
   const plugins = security.plugins;
   const mcpServers = security.mcpServers;

package/src/input/commands/session-content.ts

@@ -161,7 +161,7 @@ export function registerSessionContentCommands(registry: CommandRegistry): void
 
   registry.register({
     name: 'undo',
-    aliases: ['u'],
+    aliases: [],
     description: 'Undo last action. /undo file — revert last file write/edit. /undo — remove last conversation turn.',
     usage: '[file]',
     argsHint: '[file]',

package/src/input/commands/session.ts

@@ -347,7 +347,6 @@ export const sessionCommand: SlashCommand = {
         break;
 
       case 'cancel':
-      case 'x':
         handleCancel(rest, context);
         break;
 

package/src/input/commands/shell-core.ts

@@ -5,6 +5,7 @@ import { REASONING_BUDGET_MAP } from '@pellux/goodvibes-sdk/platform/providers/i
 import { executeWriteQuit } from './quit-shared.ts';
 import { compactConversation, requireKeybindingsManager, requireProviderApi } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
 
 export function registerShellCoreCommands(registry: CommandRegistry): void {
   registry.register({
@@ -34,7 +35,7 @@ export function registerShellCoreCommands(registry: CommandRegistry): void {
           ctx.platform.configManager.set('provider.model', selected.registryKey);
           ctx.platform.configManager.set('provider.provider', selected.providerId);
           ctx.print(`Switched to model: ${selected.displayName} (${selected.providerId})`);
-          void providerApi.recordModelUsage(selected.registryKey).catch(() => undefined);
+          void providerApi.recordModelUsage(selected.registryKey).catch((err) => { logger.debug('model usage record failed', { err }); });
         } catch (e) {
           ctx.print(`Error: ${summarizeError(e)}`);
         }
@@ -202,7 +203,7 @@ export function registerShellCoreCommands(registry: CommandRegistry): void {
 
   registry.register({
     name: 'quit',
-    aliases: ['q', ':q'],
+    aliases: [':q'],
     description: 'Exit the application',
     handler(_args, ctx) {
       ctx.exit();

package/src/input/commands/skills-runtime.ts

@@ -19,7 +19,7 @@ export function registerSkillsRuntimeCommands(registry: CommandRegistry): void {
     aliases: ['skill'],
     description: 'Inspect installed skill packs',
     usage: '[open|list|show <name>|origins|browse [query]|installed|catalog-review <id>|publish-local <id> <path> <summary...>|unpublish <id>|install-hint <catalog-id>|install <id> [project|user]|update <id> [project|user]|uninstall <id> [project|user]]',
-    handler(args, ctx) {
+    async handler(args, ctx) {
       const sub = args[0] ?? 'open';
       if (sub === 'open' || sub === 'panel') {
         if (ctx.showPanel) ctx.showPanel('skills');
@@ -31,7 +31,7 @@ export function registerSkillsRuntimeCommands(registry: CommandRegistry): void {
         }
         return;
       }
-      const skills = discoverSkills(requireShellPaths(ctx));
+      const skills = await discoverSkills(requireShellPaths(ctx));
       const ecosystemPaths = requireEcosystemCatalogPaths(ctx);
       if (sub === 'list') {
         if (skills.length === 0) {

package/src/input/commands/subscription-runtime.ts

@@ -174,7 +174,7 @@ export function registerSubscriptionRuntimeCommands(registry: CommandRegistry):
           const openBrowser = !flags.has('--no-browser');
           const useManualMode = flags.has('--manual');
           if (provider === 'openai' && resolved.source === 'builtin') {
-            const started = beginOpenAICodexLogin();
+            const started = await beginOpenAICodexLogin();
             manager.savePending({
               provider,
               state: started.state,
@@ -191,7 +191,7 @@ export function registerSubscriptionRuntimeCommands(registry: CommandRegistry):
                   host: '127.0.0.1',
                   port: 1455,
                   path: '/auth/callback',
-                }).catch(() => null);
+                }).catch(() => null); // best-effort: listener creation is optional; null triggers manual flow
               } catch {
                 listener = null;
               }
@@ -272,14 +272,14 @@ export function registerSubscriptionRuntimeCommands(registry: CommandRegistry):
               host: resolved.oauth.localCallback.host,
               port: resolved.oauth.localCallback.port,
               path: resolved.oauth.localCallback.path,
-            }).catch(() => null);
+            }).catch(() => null); // best-effort: local callback listener is optional; null falls back to manual redirect
           }
 
           if (listener) {
             activeConfig = { ...activeConfig, redirectUri: listener.redirectUri };
           }
 
-          const started = manager.beginOAuthLogin(provider, activeConfig);
+          const started = await manager.beginOAuthLogin(provider, activeConfig);
           if (listener) {
             listener.setExpectedState(started.pending.state);
           }