feat(host): quick-pick welcome screen for bare /workflow

[pmateusz]

What

Bare /workflow (no subcommand) is now the feature's front door instead of a no-op:

• TUI: replaces the ordinary editor with a compact, terminal-native quick-pick in the
  same interaction region as /settings — numbered rows, arrow/jk navigation, Enter to run,
  number-key shortcuts, Esc/Ctrl-C to dismiss, and the host restores the editor afterwards.
• RPC: same copy and actions through the host's native dialog transport.
• print/json (hasUI false): falls back to the plain /workflow list response, without
  scanning the catalog first.

Rows show each workflow's name and description; duplicate declared names get a filename hint
so rows stay distinguishable; Create new workflow is always last (and the sole action in the
empty state). Broken workflow files are surfaced as warnings in every mode and never offered
for selection. Selecting a workflow runs its exact file.

Implementation notes

• Shared catalog-option presentation (duplicate counting, filename disambiguation, description
  normalization) lives in new src/host/workflow-display.ts, used by the picker, the RPC
  dialog, and the plain listing so all three agree.
• Picker input handling is fail-closed: any throw settles the component as a dismissal so PI
  restores the editor.
• pi-tui is pulled in via dynamic import only in TUI mode — rpc/print processes never load it.
• notifyBrokenWorkflows extracted from /workflow list so broken files cannot be hidden by
  any catalog surface.

Docs & spec

• New spec §6.0 records the behavior decisions (blank top row, header copy, headless fallback,
  broken-file visibility).
• README command table gains the bare /workflow row; the trust-boundary note now covers the
  picker, which imports every workflow module just like /workflow list.

Also in this PR

• examples/external-dependency/ — a self-contained example verifying a workflow can resolve
  a third-party package (slugify) from its own package directory, plus examples/.npmignore
  so the example's node_modules stays out of the published tarball (verified with
  npm pack --dry-run). Happy to split this into its own PR if you prefer.

Testing

• New test/workflow-picker.test.ts (6 tests): screenshot-shaped rendering, empty state,
  keyboard navigation, numbered shortcuts, duplicate disambiguation, editor-slot settling,
  fail-closed path.
• New welcome/dispatch coverage in test/extension-handlers.test.ts: RPC empty/populated/
  broken states, end-to-end TUI catalog discovery through the dynamic import, headless
  fallback proving no scan occurs.
• tsc --noEmit and biome check clean.

[kimchi-review]

Kimchi Code Review

A review is being prepared and will be posted shortly.

Property	Value
Commit	48a14b1
Author	@pmateusz
Files changed	15
Review status	Pending

What to expect

Kimchi will analyze the changes in this pull request and post:

• A summary of the overall changes
• Inline comments on specific lines with findings categorized by issue type

The review typically completes within a few minutes. This comment will be updated once the review is ready.

Interact with Kimchi

• @getkimchi review — re-trigger a full review on the latest commit
• @getkimchi summary — regenerate the PR summary
• @getkimchi ignore — skip this PR (no review will be posted)
• Reply to any inline comment to ask follow-up questions or request clarification

Configuration

Reviews are configured by your organization admin.
Review instructions, excluded directories, and severity thresholds can be adjusted per repository in the Kimchi dashboard.

---

Powered by Kimchi — AI-powered code review by CAST AI