@pellux/goodvibes-tui 0.28.0 → 0.29.0

package/src/panels/security-panel.ts

@@ -6,35 +6,29 @@ import type { UiReadModel, UiSecuritySnapshot } from '../runtime/ui-read-models.
 import {
   buildAlignedRow,
   buildEmptyState,
-  buildGuidanceLine,
+  buildKeyboardHints,
   buildPanelLine,
   buildPanelWorkspace,
   buildStatusPill,
   DEFAULT_PANEL_PALETTE,
 } from './polish.ts';
 import { createEmptyLine } from '../types/grid.ts';
+import type { PanelIntegrationContext } from './types.ts';
 
-const C = {
-  ...DEFAULT_PANEL_PALETTE,
-  header: '#94a3b8',
-  headerBg: '#1e293b',
-  dim: '#475569',
-  ok: '#22c55e',
-  warn: '#eab308',
-  error: '#ef4444',
-  selectBg: '#0f172a',
-} as const;
+// Base chrome only — title band, state colors, and text tokens all come
+// straight from DEFAULT_PANEL_PALETTE (WO-002).
+const C = DEFAULT_PANEL_PALETTE;
 
 function managedColor(managed: boolean): string {
   return managed ? C.warn : C.info;
 }
 
 function resultColor(result: TokenAuditResult): string {
-  if (result.blocked) return C.error;
-  if (result.scope.outcome === 'violation') return C.error;
-  if (result.rotation.outcome === 'overdue') return C.error;
+  if (result.blocked) return C.bad;
+  if (result.scope.outcome === 'violation') return C.bad;
+  if (result.rotation.outcome === 'overdue') return C.bad;
   if (result.rotation.outcome === 'warning') return C.warn;
-  return C.ok;
+  return C.good;
 }
 
 function resultSummary(result: TokenAuditResult): string {
@@ -50,20 +44,55 @@ function severityColor(severity: 'low' | 'medium' | 'high' | 'critical'): string
   switch (severity) {
     case 'critical':
     case 'high':
-      return C.error;
+      return C.bad;
     case 'medium':
       return C.warn;
     case 'low':
     default:
-      return C.ok;
+      return C.good;
   }
 }
 
+// Relative-time formatting for audit/rotation timestamps — humanized instead
+// of raw ISO strings (WO-137). Mirrors the fmtAgo pattern already used by
+// approval-panel.ts / debug-panel.ts / communication-panel.ts.
+function fmtAgo(ts: number): string {
+  const sec = Math.max(0, Math.floor((Date.now() - ts) / 1000));
+  if (sec < 5) return 'just now';
+  if (sec < 60) return `${sec}s ago`;
+  if (sec < 3600) return `${Math.floor(sec / 60)}m ago`;
+  if (sec < 86400) return `${Math.floor(sec / 3600)}h ago`;
+  return `${Math.floor(sec / 86400)}d ago`;
+}
+
+function fmtDue(msUntilDue: number): string {
+  const overdue = msUntilDue < 0;
+  const sec = Math.floor(Math.abs(msUntilDue) / 1000);
+  const unit = sec < 3600
+    ? `${Math.max(1, Math.floor(sec / 60))}m`
+    : sec < 86400
+      ? `${Math.floor(sec / 3600)}h`
+      : `${Math.floor(sec / 86400)}d`;
+  return overdue ? `overdue by ${unit}` : `in ${unit}`;
+}
+
+// Attack-path finding rows: 3 rendered lines each (severity/route, reason,
+// evidence). Bounds the per-render window to the panel's actual height
+// instead of a fixed "3 findings" cap, and pages through the rest via
+// attackPathScroll ('[' / ']').
+const ATTACK_PATH_FINDING_LINES = 3;
+
 export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
   private readonly unsub: (() => void) | null;
+  /** Scroll offset into attackPathReview.findings (in finding units, not lines). */
+  private attackPathScroll = 0;
+  /** Set by 'f'; consumed by handlePanelIntegrationAction to dispatch /policy preflight. */
+  private pendingPreflight = false;
+  /** Set by 'i'; consumed by handlePanelIntegrationAction to jump to the incident panel. */
+  private pendingIncidentJump = false;
 
   public constructor(private readonly readModel: UiReadModel<UiSecuritySnapshot>) {
-    super('security', 'Security', 'U', 'monitoring');
+    super('security', 'Security', '▬', 'security-policy');
     this.showSelectionGutter = true; // I5: non-color selection affordance
     this.filterEnabled = true;
     this.filterLabel = 'Filter tokens';
@@ -77,9 +106,13 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
   protected override getPalette() { return C; }
   protected override getEmptyStateMessage() { return ' No API tokens are registered with the security auditor yet.'; }
   protected override getEmptyStateActions() {
+    // WO-160: '/policy preflight' dropped — 'f' already dispatches it for
+    // real (see handleInput/handlePanelIntegrationAction) and is advertised
+    // as a live key hint in the footer even in this empty state, so listing
+    // it here too was a redundant action substitute. '/storage review' and
+    // '/mcp trust' stay: neither has an in-panel key equivalent.
     return [
       { command: '/storage review', summary: 'inspect secure secret storage and environment overrides' },
-      { command: '/policy preflight', summary: 'run a live preflight posture review' },
       { command: '/mcp trust', summary: 'inspect active MCP trust and quarantine posture' },
     ];
   }
@@ -109,12 +142,58 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
 
   public handleInput(key: string): boolean {
     if (!this.filterActive && key === 'r') {
+      // Real re-audit: force the read model to recompute (ApiTokenAuditor.auditAll
+      // under the hood) right now instead of waiting on the next incidental
+      // render, so lastAuditAt visibly advances the instant 'r' is pressed.
+      this.readModel.getSnapshot();
+      this.markDirty();
+      return true;
+    }
+    if (!this.filterActive && key === 'f') {
+      this.pendingPreflight = true;
+      this.markDirty();
+      return true;
+    }
+    if (!this.filterActive && key === 'i') {
+      if (!this.readModel.getSnapshot().latestIncident) return false;
+      this.pendingIncidentJump = true;
+      this.markDirty();
+      return true;
+    }
+    if (!this.filterActive && key === '[') {
+      this.attackPathScroll = Math.max(0, this.attackPathScroll - 1);
+      this.markDirty();
+      return true;
+    }
+    if (!this.filterActive && key === ']') {
+      this.attackPathScroll += 1;
       this.markDirty();
       return true;
     }
     return super.handleInput(key);
   }
 
+  /**
+   * f (preflight) and i (jump to incident) both require the integration
+   * context (executeCommand / panelManager), which is only available here —
+   * same staged-pending-action pattern as worktree-panel.ts and
+   * incident-review-panel.ts.
+   */
+  public handlePanelIntegrationAction(_key: string, ctx: PanelIntegrationContext): boolean {
+    if (this.pendingPreflight) {
+      this.pendingPreflight = false;
+      if (!ctx.executeCommand) return false;
+      void ctx.executeCommand('policy', ['preflight']).catch(() => { /* surfaced via /policy output */ });
+      return true;
+    }
+    if (this.pendingIncidentJump) {
+      this.pendingIncidentJump = false;
+      ctx.panelManager.open('incident');
+      return true;
+    }
+    return false;
+  }
+
   protected override filterMatches(result: TokenAuditResult, q: string): boolean {
     return result.label.toLowerCase().includes(q)
       || result.scope.policyId.toLowerCase().includes(q)
@@ -136,7 +215,10 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
     const untrustedPlugins = snapshot.untrustedPlugins;
     const attackPathReview = snapshot.attackPathReview;
     const intro = 'Token audit, policy posture, MCP attack-path review, plugin trust, and incident pressure.';
-    const footerLine = buildGuidanceLine(width, '/policy preflight', 'run a proactive policy review before risky work starts', C);
+    // WO-160: dropped the printed '/policy preflight' guidance line — 'f' is
+    // already bound to dispatch it for real (see handleInput/
+    // handlePanelIntegrationAction below) and is advertised in the keyboard
+    // hints footer, so the printed command was a pure action substitute.
 
     const governanceLines: Line[] = [
       buildPanelLine(width, [
@@ -212,7 +294,7 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
           { title: 'Governance', lines: emptyStateLines },
           { title: 'Attack Paths', lines: attackPathLines },
         ],
-        footerLines: [footerLine],
+        footerLines: [buildKeyboardHints(width, [{ keys: 'f', label: 'preflight' }], C)],
         palette: C,
       });
       while (workspace.length < height) workspace.push(createEmptyLine(width));
@@ -221,7 +303,15 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
 
     if (attackPathReview.findings.length > 0) {
       attackPathLines.push(buildPanelLine(width, [[' MCP attack-path review', C.label]]));
-      for (const finding of attackPathReview.findings.slice(0, 3)) {
+      // Fully scrollable — no fixed "3 findings" cap. The visible window
+      // scales with the panel's actual height; '[' / ']' page through the
+      // rest when there are more findings than currently fit.
+      const windowSize = Math.max(1, Math.floor((height - 16) / ATTACK_PATH_FINDING_LINES));
+      const maxScroll = Math.max(0, attackPathReview.findings.length - windowSize);
+      this.attackPathScroll = Math.min(this.attackPathScroll, maxScroll);
+      const start = this.attackPathScroll;
+      const end = Math.min(attackPathReview.findings.length, start + windowSize);
+      for (const finding of attackPathReview.findings.slice(start, end)) {
         attackPathLines.push(buildPanelLine(width, [[
           truncateDisplay(`  ${finding.severity.toUpperCase()} ${finding.serverName}: ${finding.route}`, width),
           severityColor(finding.severity),
@@ -235,6 +325,12 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
           C.dim,
         ]]));
       }
+      if (attackPathReview.findings.length > windowSize) {
+        attackPathLines.push(buildPanelLine(width, [[
+          `  showing ${start + 1}-${end} of ${attackPathReview.findings.length} findings ([ / ] to scroll)`,
+          C.dim,
+        ]]));
+      }
     }
 
     // Column header for the token audit list so the aligned columns are legible.
@@ -258,7 +354,9 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
       ),
     ];
 
-    const selected = view.results[this.selectedIndex];
+    // Detail must track the filtered view the list highlights, not the raw
+    // audit results — under an applied token filter they diverge.
+    const selected = this.getSelectedItem();
     const detailLines: Line[] = [];
     if (selected) {
       detailLines.push(buildPanelLine(width, [
@@ -267,44 +365,44 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
         ['  Policy: ', C.label],
         [selected.scope.policyId, C.info],
         ['  Blocked: ', C.label],
-        [selected.blocked ? 'yes' : 'no', selected.blocked ? C.error : C.ok],
+        [selected.blocked ? 'yes' : 'no', selected.blocked ? C.bad : C.good],
       ]));
       detailLines.push(buildPanelLine(width, [
         ['  Scope: ', C.label],
-        [selected.scope.outcome, selected.scope.outcome === 'violation' ? C.error : C.ok],
+        [selected.scope.outcome, selected.scope.outcome === 'violation' ? C.bad : C.good],
         ['  Excess: ', C.label],
-        [truncateDisplay(selected.scope.excessScopes.length > 0 ? selected.scope.excessScopes.join(', ') : 'none', Math.max(0, width - 27)), selected.scope.excessScopes.length > 0 ? C.error : C.dim],
+        [truncateDisplay(selected.scope.excessScopes.length > 0 ? selected.scope.excessScopes.join(', ') : 'none', Math.max(0, width - 27)), selected.scope.excessScopes.length > 0 ? C.bad : C.dim],
       ]));
       detailLines.push(buildPanelLine(width, [
         ['  Rotation: ', C.label],
-        [selected.rotation.outcome, selected.rotation.outcome === 'ok' ? C.ok : selected.rotation.outcome === 'warning' ? C.warn : C.error],
+        [selected.rotation.outcome, selected.rotation.outcome === 'ok' ? C.good : selected.rotation.outcome === 'warning' ? C.warn : C.bad],
         ['  Due: ', C.label],
-        [new Date(selected.rotation.dueAt).toISOString(), C.value],
+        [fmtDue(selected.rotation.msUntilDue), selected.rotation.msUntilDue < 0 ? C.bad : C.value],
         ['  Age(d): ', C.label],
         [String(Math.floor(selected.rotation.ageMs / (24 * 60 * 60 * 1000))), C.value],
       ]));
       detailLines.push(buildPanelLine(width, [[
-        `Last audit: ${view.lastAuditAt ? new Date(view.lastAuditAt).toISOString() : 'never'}  Press r to refresh.`,
+        `Last audit: ${view.lastAuditAt ? fmtAgo(view.lastAuditAt) : 'never'}  Press r to refresh.`,
         C.dim,
       ]]));
       if (preflightStatus !== 'n/a') {
         detailLines.push(buildPanelLine(width, [[
           truncateDisplay(`Policy preflight: ${preflightStatus} (${preflightIssueCount} issue${preflightIssueCount === 1 ? '' : 's'})`, width),
-          preflightStatus === 'block' ? C.error : preflightStatus === 'warn' ? C.warn : C.dim,
+          preflightStatus === 'block' ? C.bad : preflightStatus === 'warn' ? C.warn : C.dim,
         ]]));
       }
       if (quarantinedMcp.length > 0) {
         const server = quarantinedMcp[0]!;
         detailLines.push(buildPanelLine(width, [[
           truncateDisplay(`MCP quarantine: ${server.name} ${server.quarantineReason ?? 'unknown'}${server.quarantineDetail ? ` - ${server.quarantineDetail}` : ''}`, width),
-          C.error,
+          C.bad,
         ]]));
       }
       if (quarantinedPlugins.length > 0) {
         const plugin = quarantinedPlugins[0]!;
         detailLines.push(buildPanelLine(width, [[
           truncateDisplay(`Plugin quarantine: ${plugin.name} (${plugin.trustTier})`, width),
-          C.error,
+          C.bad,
         ]]));
       } else if (untrustedPlugins.length > 0) {
         const plugin = untrustedPlugins[0]!;
@@ -331,6 +429,9 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
           { keys: '↑/↓', label: 'select token' },
           { keys: '/', label: 'filter' },
           { keys: 'r', label: 'refresh audit' },
+          { keys: 'f', label: 'preflight' },
+          ...(latestIncident ? [{ keys: 'i', label: 'jump to incident' }] : []),
+          ...(attackPathReview.findings.length > 0 ? [{ keys: '[ / ]', label: 'scroll attack paths' }] : []),
         ];
 
     return this.renderList(width, height, {
@@ -339,7 +440,6 @@ export class SecurityPanel extends ScrollableListPanel<TokenAuditResult> {
       footer: [
         ...detailLines,
         ...attackPathLines,
-        footerLine,
       ],
       hints,
     });

package/src/panels/services-panel.ts

@@ -2,11 +2,13 @@ import type { Line } from '../types/grid.ts';
 import { createEmptyLine } from '../types/grid.ts';
 import { truncateDisplay } from '../utils/terminal-width.ts';
 import { ScrollableListPanel } from './scrollable-list-panel.ts';
+import type { PanelIntegrationContext } from './types.ts';
 import {
   type ServiceConfig,
   type ServiceInspection,
   type ServiceConnectionTestResult,
 } from '@pellux/goodvibes-sdk/platform/config';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { ServiceInspectionQuery, SubscriptionAccessQuery } from '../runtime/ui-service-queries.ts';
 import {
   buildDetailBlock,
@@ -18,28 +20,21 @@ import {
   DEFAULT_PANEL_PALETTE,
 } from './polish.ts';
 
-const C = {
-  ...DEFAULT_PANEL_PALETTE,
-  header: '#94a3b8',
-  headerBg: '#1e293b',
-  label: '#64748b',
-  value: '#e2e8f0',
-  dim: '#475569',
-  ok: '#22c55e',
-  warn: '#eab308',
-  error: '#ef4444',
-  info: '#38bdf8',
-  selectBg: '#0f172a',
-  empty: '#334155',
-} as const;
+// Base chrome only — title band, state colors, and text tokens all come
+// straight from DEFAULT_PANEL_PALETTE (WO-002).
+const C = DEFAULT_PANEL_PALETTE;
 
 interface ServicePanelEntry {
   readonly name: string;
-  readonly inspection: ServiceInspection;
+  // null when registry.inspect(name) resolved null (e.g. a config entry that
+  // disappeared or failed to resolve between getAll() and inspect()) — the
+  // row still renders, flagged, instead of crashing the whole refresh.
+  readonly inspection: ServiceInspection | null;
   readonly lastTest?: ServiceConnectionTestResult;
 }
 
 function statusLabel(entry: ServicePanelEntry): string {
+  if (!entry.inspection) return 'INSPECT FAILED';
   if (!entry.inspection.hasPrimaryCredential) return 'UNCONFIGURED';
   if (entry.lastTest?.ok) return 'HEALTHY';
   if (entry.lastTest && !entry.lastTest.ok) return 'ERROR';
@@ -48,8 +43,8 @@ function statusLabel(entry: ServicePanelEntry): string {
 
 function statusColor(entry: ServicePanelEntry): string {
   const label = statusLabel(entry);
-  if (label === 'HEALTHY') return C.ok;
-  if (label === 'ERROR') return C.error;
+  if (label === 'HEALTHY') return C.good;
+  if (label === 'ERROR' || label === 'INSPECT FAILED') return C.bad;
   if (label === 'CONFIGURED') return C.warn;
   return C.dim;
 }
@@ -76,12 +71,16 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
   private readonly subscriptionManager: SubscriptionAccessQuery;
   private entries: ServicePanelEntry[] = [];
   private loading = false;
+  // s = open the Subscription panel via the handleInput -> handlePanelIntegrationAction
+  // bridge (handleInput has no ctx.panelManager — same pattern used elsewhere in
+  // this wave, e.g. session-browser-panel.ts's pendingOpenPanels).
+  private pendingOpenSubscription = false;
 
   public constructor(
     registry: ServiceInspectionQuery,
     subscriptionManager: SubscriptionAccessQuery,
   ) {
-    super('services', 'Services', 'V', 'monitoring');
+    super('services', 'Services', 'V', 'providers');
     this.showSelectionGutter = true; // I5: non-color selection affordance
     this.filterEnabled = true;
     this.filterLabel = 'Filter services';
@@ -92,7 +91,7 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
 
   protected override filterMatches(entry: ServicePanelEntry, q: string): boolean {
     return entry.name.toLowerCase().includes(q)
-      || (entry.inspection.config.baseUrl ?? '').toLowerCase().includes(q);
+      || (entry.inspection?.config.baseUrl ?? '').toLowerCase().includes(q);
   }
 
   public override onActivate(): void {
@@ -107,7 +106,7 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
   protected override getEmptyStateActions() {
     return [
       { command: '/services auth-review', summary: 'inspect service auth posture and registry config' },
-      { command: '/subscription', summary: 'review provider login state and override posture' },
+      { command: 's', summary: 'open the Subscription panel — review provider login state and override posture' },
     ];
   }
 
@@ -117,12 +116,14 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
 
   protected renderItem(entry: ServicePanelEntry, index: number, selected: boolean, width: number): Line {
     const bg = selected ? C.selectBg : undefined;
+    const authText = entry.inspection ? authSummary(entry.inspection.config, this.subscriptionManager) : 'n/a';
+    const baseUrlText = entry.inspection ? (entry.inspection.config.baseUrl ?? '(no baseUrl)') : '(inspection failed)';
     return buildPanelLine(width, [
       [' ', C.label, bg],
       [entry.name.padEnd(16), C.value, bg],
       [` ${statusLabel(entry).padEnd(12)}`, statusColor(entry), bg],
-      [` ${authSummary(entry.inspection.config, this.subscriptionManager).padEnd(18)}`, C.info, bg],
-      [` ${truncateDisplay(entry.inspection.config.baseUrl ?? '(no baseUrl)', Math.max(0, width - 48))}`, C.dim, bg],
+      [` ${authText.padEnd(18)}`, C.info, bg],
+      [` ${truncateDisplay(baseUrlText, Math.max(0, width - 48))}`, C.dim, bg],
     ]);
   }
 
@@ -136,43 +137,85 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
         void this.testSelected();
         return true;
       }
+      if (key === 'T') {
+        void this.testAll();
+        return true;
+      }
+      if (key === 's') {
+        this.pendingOpenSubscription = true;
+        return true;
+      }
     }
     return super.handleInput(key);
   }
 
+  /** Drains the 's' key's pending open request via the ctx.panelManager bridge. */
+  handlePanelIntegrationAction(_key: string, ctx: PanelIntegrationContext): boolean {
+    if (!this.pendingOpenSubscription) return false;
+    this.pendingOpenSubscription = false;
+    ctx.panelManager.open('subscription');
+    return true;
+  }
+
   private async refresh(): Promise<void> {
     this.loading = true;
     this.markDirty();
-    const configs = this.registry.getAll();
-    const names = Object.keys(configs).sort((a, b) => a.localeCompare(b));
-    const inspections = await Promise.all(
-      names.map(async (name) => ({
-        name,
-        inspection: (await this.registry.inspect(name))!,
-      })),
-    );
-    const previousTests = new Map(this.entries.map((entry) => [entry.name, entry.lastTest] as const));
-    this.entries = inspections.map((entry) => ({
-      ...entry,
-      ...(previousTests.get(entry.name) ? { lastTest: previousTests.get(entry.name) } : {}),
-    }));
-    this.selectedIndex = Math.min(this.selectedIndex, Math.max(0, this.entries.length - 1));
-    this.loading = false;
-    this.markDirty();
+    try {
+      const configs = this.registry.getAll();
+      const names = Object.keys(configs).sort((a, b) => a.localeCompare(b));
+      const inspections = await Promise.all(
+        names.map(async (name) => ({
+          name,
+          inspection: await this.registry.inspect(name),
+        })),
+      );
+      const previousTests = new Map(this.entries.map((entry) => [entry.name, entry.lastTest] as const));
+      this.entries = inspections.map((entry) => ({
+        ...entry,
+        ...(previousTests.get(entry.name) ? { lastTest: previousTests.get(entry.name) } : {}),
+      }));
+      this.selectedIndex = Math.min(this.selectedIndex, Math.max(0, this.entries.length - 1));
+    } catch (e) {
+      this.setError(`Refresh failed: ${summarizeError(e)}`);
+    } finally {
+      // Always clear the loading flag — a thrown getAll()/inspect() must
+      // never leave the panel stuck on the "Loading configured services..." screen.
+      this.loading = false;
+      this.markDirty();
+    }
   }
 
   private async testSelected(): Promise<void> {
-    const selected = this.entries[this.selectedIndex];
+    // selectedIndex tracks the filtered view, so the acted-on entry must come
+    // from getVisibleItems() — this.entries would desync under a '/' filter.
+    const selected = this.getSelectedItem();
     if (!selected) return;
-    const result = await this.registry.testConnection(selected.name);
-    this.entries = this.entries.map((entry) => (
-      entry.name === selected.name
-        ? { ...entry, lastTest: result }
-        : entry
-    ));
+    try {
+      const result = await this.registry.testConnection(selected.name);
+      this.entries = this.entries.map((entry) => (
+        entry.name === selected.name
+          ? { ...entry, lastTest: result }
+          : entry
+      ));
+    } catch (e) {
+      this.setError(`Test failed: ${summarizeError(e)}`);
+    }
     this.markDirty();
   }
 
+  /** T = test every configured service's connection, one call per row (services-runtime.ts's single-service test pattern, looped). */
+  private async testAll(): Promise<void> {
+    for (const entry of this.entries) {
+      try {
+        const result = await this.registry.testConnection(entry.name);
+        this.entries = this.entries.map((e) => (e.name === entry.name ? { ...e, lastTest: result } : e));
+      } catch (e) {
+        this.setError(`Test failed for ${entry.name}: ${summarizeError(e)}`);
+      }
+      this.markDirty();
+    }
+  }
+
   public render(width: number, height: number): Line[] {
     this.clampSelection();
     const intro = 'Credential posture, subscription overrides, and live connection checks for configured services.';
@@ -200,13 +243,14 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
     const headerLines: Line[] = [
       buildKeyValueLine(width, [
         { label: 'services', value: String(this.entries.length), valueColor: this.entries.length > 0 ? C.info : C.dim },
-        { label: 'healthy', value: String(counts.healthy), valueColor: counts.healthy > 0 ? C.ok : C.dim },
-        { label: 'errors', value: String(counts.error), valueColor: counts.error > 0 ? C.error : C.dim },
+        { label: 'healthy', value: String(counts.healthy), valueColor: counts.healthy > 0 ? C.good : C.dim },
+        { label: 'errors', value: String(counts.error), valueColor: counts.error > 0 ? C.bad : C.dim },
         { label: 'unconfigured', value: String(counts.unconfigured), valueColor: counts.unconfigured > 0 ? C.warn : C.dim },
       ], C),
     ];
 
-    const selected = this.entries[this.selectedIndex];
+    // Detail must describe the row the (possibly filtered) list highlights.
+    const selected = this.getSelectedItem();
     const detailRows: Line[] = [];
     if (selected) {
       const inspect = selected.inspection;
@@ -216,22 +260,28 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
         ['  State: ', C.label],
         [statusLabel(selected), statusColor(selected)],
         ['  Auth: ', C.label],
-        [authSummary(inspect.config, this.subscriptionManager), C.info],
-      ]));
-      detailRows.push(buildPanelLine(width, [
-        ['  Base URL: ', C.label],
-        [truncateDisplay(inspect.config.baseUrl ?? '(no baseUrl)', Math.max(0, width - 13)), C.dim],
-      ]));
-      detailRows.push(buildPanelLine(width, [
-        ['  Primary credential: ', C.label],
-        ...buildStatusPill(inspect.hasPrimaryCredential ? 'good' : 'bad', inspect.hasPrimaryCredential ? 'present' : 'missing'),
-        ['  Webhook URL: ', C.label],
-        ...buildStatusPill(inspect.hasWebhookUrl ? 'good' : 'info', inspect.hasWebhookUrl ? 'present' : 'missing'),
-        ['  Signing secret: ', C.label],
-        ...buildStatusPill(inspect.hasSigningSecret ? 'good' : 'info', inspect.hasSigningSecret ? 'present' : 'missing'),
-        ['  App token: ', C.label],
-        ...buildStatusPill(inspect.hasAppToken ? 'good' : 'info', inspect.hasAppToken ? 'present' : 'missing'),
+        [inspect ? authSummary(inspect.config, this.subscriptionManager) : 'n/a', C.info],
       ]));
+      if (!inspect) {
+        detailRows.push(buildPanelLine(width, [
+          ['  Inspection failed — the registry could not resolve this service\'s config. Press r to retry.', C.bad],
+        ]));
+      } else {
+        detailRows.push(buildPanelLine(width, [
+          ['  Base URL: ', C.label],
+          [truncateDisplay(inspect.config.baseUrl ?? '(no baseUrl)', Math.max(0, width - 13)), C.dim],
+        ]));
+        detailRows.push(buildPanelLine(width, [
+          ['  Primary credential: ', C.label],
+          ...buildStatusPill(inspect.hasPrimaryCredential ? 'good' : 'bad', inspect.hasPrimaryCredential ? 'present' : 'missing'),
+          ['  Webhook URL: ', C.label],
+          ...buildStatusPill(inspect.hasWebhookUrl ? 'good' : 'info', inspect.hasWebhookUrl ? 'present' : 'missing'),
+          ['  Signing secret: ', C.label],
+          ...buildStatusPill(inspect.hasSigningSecret ? 'good' : 'info', inspect.hasSigningSecret ? 'present' : 'missing'),
+          ['  App token: ', C.label],
+          ...buildStatusPill(inspect.hasAppToken ? 'good' : 'info', inspect.hasAppToken ? 'present' : 'missing'),
+        ]));
+      }
       if (selected.lastTest) {
         detailRows.push(buildPanelLine(width, [
           ['  Last test: ', C.label],
@@ -244,7 +294,7 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
         if (selected.lastTest.error) {
           detailRows.push(buildPanelLine(width, [
             ['  Error: ', C.label],
-            [truncateDisplay(selected.lastTest.error, Math.max(0, width - 10)), C.error],
+            [truncateDisplay(selected.lastTest.error, Math.max(0, width - 10)), C.bad],
           ]));
         }
       } else {
@@ -259,8 +309,10 @@ export class ServicesPanel extends ScrollableListPanel<ServicePanelEntry> {
       : [
           { keys: 'Up/Down', label: 'move' },
           ...(selected ? [{ keys: 't', label: 'test selected' }] : []),
+          ...(this.entries.length > 0 ? [{ keys: 'T', label: 'test all' }] : []),
           { keys: 'r', label: 'refresh' },
           { keys: '/', label: 'filter' },
+          { keys: 's', label: 'subscription panel' },
         ];
 
     const footer: Line[] = selected