forkit-connect 0.1.0 → 0.1.1

package/dist/cli.js

@@ -38,6 +38,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: 0,
         maxWorkspaces: 0,
         maxProjects: 0,
+        maxGovernedPassports: 0,
         runtimeSignalsPerMonth: null,
     },
     signal: {
@@ -45,6 +46,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: 25,
         maxWorkspaces: 3,
         maxProjects: 3,
+        maxGovernedPassports: 3,
         runtimeSignalsPerMonth: 10000,
     },
     protocol: {
@@ -52,6 +54,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: 20,
         maxWorkspaces: null,
         maxProjects: null,
+        maxGovernedPassports: null,
         runtimeSignalsPerMonth: 250000,
     },
     sovereign: {
@@ -59,6 +62,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: null,
         maxWorkspaces: null,
         maxProjects: null,
+        maxGovernedPassports: null,
         runtimeSignalsPerMonth: null,
     },
 };
@@ -151,6 +155,13 @@ function advancedUsage() {
     console.log('  --heartbeat-gaid <gaid> Queue heartbeat runtime signal event for GAID');
     console.log('  --heartbeat-key <key>   API key used for heartbeat runtime signal event');
     console.log('                          Also used by: c2 set-key (stores key + backfills events)');
+    console.log('  --gaid <gaid>           Passport GAID used by c2 run-log emit');
+    console.log('  --api-key <key>         Runtime signal API key used by c2 run-log emit');
+    console.log('  --provider <name>       Provider label used by c2 run-log emit');
+    console.log('  --service-name <name>   Service/agent/workflow label used by c2 run-log emit');
+    console.log('  --prompt-tokens <n>     Prompt tokens used by c2 run-log emit');
+    console.log('  --completion-tokens <n> Completion tokens used by c2 run-log emit');
+    console.log('  --draft-only            Allow draft creation even when governed publish capacity is full');
 }
 function showUsage() {
     if (hasFlag('--advanced-help')) {
@@ -169,6 +180,13 @@ function getArg(flag) {
 function hasFlag(flag) {
     return process.argv.slice(2).includes(flag);
 }
+function getNumericArg(flag) {
+    const value = getArg(flag);
+    if (value === null)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
 function isHelpCommand(command) {
     return command === 'help' || command === '--help' || command === '-h' || command === '--advanced-help';
 }
@@ -182,6 +200,20 @@ function sleep(ms) {
         delay(resolve, ms);
     });
 }
+async function withTimeout(promise, timeoutMs, fallbackValue) {
+    return new Promise((resolve) => {
+        const timeout = setTimeout(() => resolve(fallbackValue), Math.max(0, timeoutMs));
+        promise
+            .then((value) => {
+            clearTimeout(timeout);
+            resolve(value);
+        })
+            .catch(() => {
+            clearTimeout(timeout);
+            resolve(fallbackValue);
+        });
+    });
+}
 function isDeviceConnectStartResponse(body) {
     if (!body || typeof body !== 'object')
         return false;
@@ -220,12 +252,11 @@ function printDeviceLoginInstructions(start) {
     console.log('[forkit-connect] Keep this terminal open while Forkit Connect waits for approval.');
 }
 function printSessionExportFallback(token) {
+    void token;
     console.log('[forkit-connect] Approval succeeded, but secure credential storage is unavailable in this Linux session.');
     console.log('[forkit-connect] Forkit Connect can keep using this approved session in the current interactive run.');
-    console.log('[forkit-connect] To keep working in this terminal right now, export the session reference manually:');
-    console.log(`export FORKIT_CONNECT_SESSION_REF='${token}'`);
-    console.log('[forkit-connect] Then rerun: forkit-connect status');
-    console.log('[forkit-connect] For a persistent and safer setup, install libsecret-tools and run forkit-connect login again.');
+    console.log('[forkit-connect] For persistent login, install libsecret-tools and run forkit-connect login again.');
+    console.log('[forkit-connect] Headless automation may pass FORKIT_CONNECT_SESSION_REF explicitly, but Connect will not print session tokens.');
 }
 function hasLinuxGuiSession() {
     if (process.platform !== 'linux') {
@@ -300,6 +331,9 @@ function formatRemainingLimit(limit, used, singular, plural = `${singular}s`) {
     const remaining = Math.max(safeLimit - safeUsed, 0);
     return `${remaining} left (${safeUsed}/${safeLimit} used)`;
 }
+function isCapacityExhausted(limit, remaining) {
+    return Number.isFinite(limit) && Number(remaining) <= 0;
+}
 function formatWorkspaceAccessLine(workspace) {
     const workspaceId = String(workspace.id || workspace.gaid || workspace.passportGaid || 'unknown');
     return `- ${summarizeWorkspaceLabel(workspace)} | id=${workspaceId}`;
@@ -577,6 +611,11 @@ function printJson(value) {
     console.log(JSON.stringify(value, null, 2));
 }
 const INTERACTIVE_LABEL_WIDTH = 24;
+const INTERACTIVE_DISCOVERY_TIMEOUT_MS = 800;
+const INTERACTIVE_BINDING_TIMEOUT_MS = 800;
+const INTERACTIVE_ACCOUNT_LIMITS_TIMEOUT_MS = 700;
+const SESSION_STATE_CHECK_TIMEOUT_MS = 3000;
+const STATUS_BINDING_TIMEOUT_MS = 800;
 function canRenderInteractiveShell() {
     return Boolean(node_process_1.stdin.isTTY && node_process_1.stdout.isTTY);
 }
@@ -628,11 +667,8 @@ function shellListLine(value) {
     return `• ${value}`;
 }
 function buildInteractiveOverviewSections(service, sessionState, accountLimits) {
-    const overview = service.getConnectStatusOverview();
-    const inbox = service.buildSmartRegistrationInbox();
-    const leftoverReady = inbox.groups.ready_to_connect.slice(0, 4).map((item) => shellListLine(item.display_name));
-    const leftoverNeedsConfirmation = inbox.groups.needs_confirmation.slice(0, 4).map((item) => shellListLine(item.display_name));
-    const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+    const accountTrusted = sessionState === 'authorized';
+    const overview = service.getConnectStatusOverview({ includeInbox: false });
     const preparedWorkspace = accountTrusted ? String(overview.workspace_id || '').trim() : '';
     const preparedProject = accountTrusted ? String(overview.project_id || '').trim() : '';
     // Base section: always visible
@@ -673,6 +709,9 @@ function buildInteractiveOverviewSections(service, sessionState, accountLimits)
                 lines: [
                     shellLine('Plan', accountLimits.planName),
                     shellLine('Private passports', formatRemainingLimit(accountLimits.privatePassportsLimit, accountLimits.privatePassportsUsed, 'private passport')),
+                    ...(accountLimits.governedPassportsLimit !== null || accountLimits.governedPassportsUsed !== null
+                        ? [shellLine('Governed passports', formatRemainingLimit(accountLimits.governedPassportsLimit, accountLimits.governedPassportsUsed, 'governed passport'))]
+                        : []),
                     shellLine('Drafts', formatRemainingLimit(accountLimits.draftLimit, accountLimits.draftsUsed, 'draft')),
                     shellLine('Workspaces', formatRemainingLimit(accountLimits.workspaceLimit, accountLimits.workspacesUsed, 'workspace')),
                     shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
@@ -687,10 +726,8 @@ function buildInteractiveOverviewSections(service, sessionState, accountLimits)
             lines: [
                 shellLine('Workspace', formatScopeReferenceLabel(preparedWorkspace || null, 'workspace')),
                 shellLine('Project', formatScopeReferenceLabel(preparedProject || null, 'project')),
-                shellLine('Ready to connect', inbox.groups.ready_to_connect.length),
-                shellLine('Needs confirmation', inbox.groups.needs_confirmation.length),
-                ...leftoverReady,
-                ...leftoverNeedsConfirmation,
+                shellLine('Ready to connect', overview.ready_to_connect_count),
+                shellLine('Needs confirmation', overview.needs_confirmation_count),
             ],
         });
     }
@@ -1227,7 +1264,9 @@ async function checkBackendSessionState(service) {
         baseUrl: DEFAULT_BASE_URL,
         sessionRef: sessionRefValue,
     });
-    const result = await api.getProfileAccess();
+    const result = await withTimeout(api.getProfileAccess(), SESSION_STATE_CHECK_TIMEOUT_MS, null);
+    if (!result)
+        return 'unavailable';
     if (result.ok)
         return 'authorized';
     if (result.status === 401 || result.status === 403)
@@ -1434,18 +1473,27 @@ async function run() {
     const runPublicConnectInit = () => {
         printConnectInit(service.initializeConnectIdentity());
     };
+    const withSmartInboxSnapshotCounts = (overview) => {
+        const inbox = service.getSmartRegistrationInbox({
+            preferSnapshot: true,
+            refreshInBackground: false,
+        });
+        return {
+            ...overview,
+            ready_to_connect_count: inbox.summary.ready_to_connect_count,
+            needs_confirmation_count: inbox.summary.needs_confirmation_count,
+            connected_count: inbox.summary.connected_count,
+            next_recommended_action: inbox.summary.next_recommended_action,
+        };
+    };
     const runPublicConnectStatus = async () => {
         const sessionState = await checkBackendSessionState(service);
+        const secureStorage = service.getCredentialStoreStatus();
         if (service.readSessionRef()) {
-            try {
-                await service.refreshEffectiveBinding();
-            }
-            catch {
-                // Status remains useful with the last local binding snapshot.
-            }
+            await withTimeout(service.refreshEffectiveBinding(), STATUS_BINDING_TIMEOUT_MS, undefined);
         }
-        const overview = service.getConnectStatusOverview();
-        const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+        const accountTrusted = sessionState === 'authorized';
+        const overview = withSmartInboxSnapshotCounts(service.getConnectStatusOverview({ includeInbox: false }));
         const localScopeCached = Boolean(String(overview.workspace_id || '').trim() || String(overview.project_id || '').trim());
         const displayOverview = accountTrusted
             ? overview
@@ -1466,23 +1514,50 @@ async function run() {
                 session_truth: accountTrusted ? 'account_verified_or_offline' : 'local_scope_cached_login_required',
                 local_scope_cached: !accountTrusted && localScopeCached,
                 binding_truth: accountTrusted ? 'account_binding_active' : 'account_login_required',
+                secure_storage: {
+                    backend: secureStorage.backend,
+                    available: secureStorage.available,
+                    plaintext_fallback_active: secureStorage.plaintextFallbackActive,
+                    legacy_plaintext_file_present: secureStorage.legacyPlaintextFilePresent,
+                    detail: secureStorage.detail,
+                },
             });
             return;
         }
         printPublicStatusOverview(displayOverview);
         console.log(`- session=${sessionState}`);
         console.log(`- binding_truth=${accountTrusted ? 'account_binding_active' : 'account_login_required'}`);
+        console.log(`- secure_storage_backend=${secureStorage.backend} available=${secureStorage.available} plaintext_fallback=${secureStorage.plaintextFallbackActive}`);
+        if (!secureStorage.available || secureStorage.plaintextFallbackActive) {
+            console.log(`- secure_storage_detail=${secureStorage.detail}`);
+        }
         if (!accountTrusted && localScopeCached) {
             console.log('- local_scope_cached=true');
         }
         printPublicStatusGuidance(displayOverview, sessionState);
     };
-    const runPublicConnectInbox = () => {
-        const inbox = service.buildSmartRegistrationInbox();
+    const runPublicConnectInbox = async () => {
+        const forceRefresh = hasFlag('--refresh');
+        const inbox = service.getSmartRegistrationInbox({
+            forceRefresh,
+            preferSnapshot: !forceRefresh,
+            refreshInBackground: !forceRefresh,
+        });
         if (hasFlag('--json')) {
             printJson(inbox);
             return;
         }
+        const freshness = inbox.summary.freshness_state ?? 'fresh';
+        const ageSeconds = Number.isFinite(inbox.summary.snapshot_age_seconds)
+            ? Number(inbox.summary.snapshot_age_seconds)
+            : 0;
+        console.log(`[forkit-connect] Inbox snapshot freshness=${freshness} age_seconds=${ageSeconds}`);
+        if (freshness === 'stale') {
+            console.log('[forkit-connect] Snapshot is stale. Run `forkit-connect inbox --refresh` for immediate reconcile.');
+        }
+        else if (freshness === 'syncing') {
+            console.log('[forkit-connect] Background reconcile is running; results will self-refresh after completion.');
+        }
         printSmartInbox(inbox);
     };
     const runPublicCollectedChanges = () => {
@@ -1571,10 +1646,11 @@ async function run() {
     const runPublicLogout = () => {
         const currentSessionRef = String(service.readSessionRef() || '').trim();
         const hadEnvironmentSession = Boolean(String(process.env.FORKIT_CONNECT_SESSION_REF || '').trim());
+        const logoutAt = new Date().toISOString();
         delete process.env.FORKIT_CONNECT_SESSION_REF;
         try {
             service.setSessionRef(null);
-            console.log('[forkit-connect] Logged out. Local discovery remains available on this device.');
+            console.log(`[forkit-connect] Logged out at ${logoutAt}. Local discovery remains available on this device.`);
             if (hadEnvironmentSession) {
                 console.log('[forkit-connect] The in-process fallback session was cleared for this run.');
             }
@@ -1583,12 +1659,12 @@ async function run() {
         catch (error) {
             if (error instanceof credential_store_1.ConnectCredentialStoreError) {
                 if (currentSessionRef) {
-                    console.log('[forkit-connect] Logged out from the current interactive run.');
+                    console.log(`[forkit-connect] Logged out from the current interactive run at ${logoutAt}.`);
                     console.log('[forkit-connect] If you previously exported a session in your shell, remove it there with:');
                     console.log('unset FORKIT_CONNECT_SESSION_REF');
                     return;
                 }
-                console.log('[forkit-connect] No stored session found.');
+                console.log(`[forkit-connect] No stored session found at ${logoutAt}.`);
                 console.log('[forkit-connect] If you previously exported a session in this shell, remove it with:');
                 console.log('unset FORKIT_CONNECT_SESSION_REF');
                 return;
@@ -1644,6 +1720,7 @@ async function run() {
                 try {
                     service.setSessionRef(polled.body.connect_access_token);
                     await service.refreshEffectiveBinding();
+                    await withTimeout(service.prewarmSmartRegistrationInbox(), 1800, undefined);
                     const displayName = getSessionDisplayName(polled.body.connect_access_token);
                     console.log(displayName
                         ? `[forkit-connect] Login approved. Welcome, ${displayName}. Session credentials stored securely.`
@@ -1653,6 +1730,7 @@ async function run() {
                 catch (error) {
                     if (error instanceof credential_store_1.ConnectCredentialStoreError) {
                         await activateEnvironmentSessionFallback(polled.body.connect_access_token);
+                        await withTimeout(service.prewarmSmartRegistrationInbox(), 1800, undefined);
                         printSessionExportFallback(polled.body.connect_access_token);
                         const displayName = getSessionDisplayName(polled.body.connect_access_token);
                         console.log(displayName
@@ -1709,16 +1787,11 @@ async function run() {
     const buildWorkspaceStatusPayload = async () => {
         const sessionState = await checkBackendSessionState(service);
         if (service.readSessionRef()) {
-            try {
-                await service.refreshEffectiveBinding();
-            }
-            catch {
-                // Keep local scope view available.
-            }
+            await withTimeout(service.refreshEffectiveBinding(), STATUS_BINDING_TIMEOUT_MS, undefined);
         }
-        const overview = service.getConnectStatusOverview();
         const operatingMode = resolveOperatingMode(service);
-        const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+        const accountTrusted = sessionState === 'authorized';
+        const overview = withSmartInboxSnapshotCounts(service.getConnectStatusOverview({ includeInbox: false }));
         const localScopeCached = Boolean(String(overview.workspace_id || '').trim() || String(overview.project_id || '').trim());
         return {
             session_state: sessionState,
@@ -1739,7 +1812,9 @@ async function run() {
         };
     };
     const renderInteractiveStatusScreen = async (sessionState) => {
-        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const accountLimits = node_process_1.stdin.isTTY && node_process_1.stdout.isTTY
+            ? await withTimeout(loadCliAccountLimits().catch(() => null), INTERACTIVE_ACCOUNT_LIMITS_TIMEOUT_MS, null)
+            : null;
         const displayName = accountLimits?.displayName ?? getSessionDisplayName(service.readSessionRef());
         renderInteractiveScreen('Forkit Connect', {
             subtitle: displayName ? `Welcome back, ${displayName}` : 'Interactive overview',
@@ -1788,18 +1863,8 @@ async function run() {
         // Only run discovery and binding refresh when the user has a session.
         // Pre-login, these calls add significant startup latency with no user benefit.
         if (service.readSessionRef()) {
-            try {
-                await service.runDiscoveryCycle();
-            }
-            catch {
-                // Keep the interactive shell usable even if local discovery has transient issues.
-            }
-            try {
-                await service.refreshEffectiveBinding();
-            }
-            catch {
-                // Use the latest local binding snapshot when backend refresh is unavailable.
-            }
+            await withTimeout(service.runDiscoveryCycle(), INTERACTIVE_DISCOVERY_TIMEOUT_MS, undefined);
+            await withTimeout(service.refreshEffectiveBinding(), INTERACTIVE_BINDING_TIMEOUT_MS, undefined);
         }
     };
     const runInteractiveWorkspaceMenu = async () => {
@@ -2394,7 +2459,10 @@ async function run() {
         }
     };
     const buildInteractiveRegisterCandidates = () => {
-        const inbox = service.buildSmartRegistrationInbox();
+        const inbox = service.getSmartRegistrationInbox({
+            preferSnapshot: true,
+            refreshInBackground: true,
+        });
         const candidates = new Map();
         const groups = ['needs_confirmation', 'ready_to_connect'];
         const state = service.getStateStore().readState();
@@ -2654,7 +2722,10 @@ async function run() {
         await runInteractiveAutoRefresh();
         const groupOrder = ['needs_confirmation', 'ready_to_connect', 'connected', 'ignored'];
         while (true) {
-            const inbox = service.buildSmartRegistrationInbox();
+            const inbox = service.getSmartRegistrationInbox({
+                preferSnapshot: true,
+                refreshInBackground: true,
+            });
             const entries = groupOrder.flatMap((group) => inbox.groups[group].map((item) => ({ group, item })));
             if (entries.length === 0) {
                 renderInteractiveScreen('Smart Registration Inbox', {
@@ -2669,7 +2740,7 @@ async function run() {
                 return;
             }
             renderInteractiveScreen('Smart Registration Inbox', {
-                subtitle: `Generated at ${inbox.summary.generated_at}`,
+                subtitle: `Generated at ${inbox.summary.generated_at} · freshness=${inbox.summary.freshness_state ?? 'fresh'}`,
                 sections: buildInteractiveInboxSections(inbox),
                 footerLines: ['Choose an inbox item below.'],
             });
@@ -2704,11 +2775,15 @@ async function run() {
         }
     };
     const runInteractiveStart = async () => {
+        if (!node_process_1.stdin.isTTY || !node_process_1.stdout.isTTY) {
+            const sessionState = service.readSessionRef() ? 'unavailable' : 'missing';
+            await renderInteractiveStatusScreen(sessionState);
+            return;
+        }
         while (true) {
             process.exitCode = 0;
-            await runInteractiveAutoRefresh();
             const sessionState = await checkBackendSessionState(service);
-            const authenticated = sessionState === 'authorized' || (sessionState === 'unavailable' && Boolean(service.readSessionRef()));
+            const authenticated = sessionState === 'authorized';
             if (!authenticated) {
                 await renderInteractiveStatusScreen(sessionState);
                 const selected = await promptSelection('Choose an action', [
@@ -2765,6 +2840,8 @@ async function run() {
                 { value: 'exit', label: 'Exit' },
             ]);
             if (!selected || selected === 'exit') {
+                const exitAt = new Date().toISOString();
+                console.log(`[forkit-connect] Quit at ${exitAt}. Interactive work stopped for this device; use logout if you want to clear the session reference.`);
                 return;
             }
             if (selected === 'status') {
@@ -2964,6 +3041,10 @@ async function run() {
                 runtimeSignalsUsed: null,
                 runtimeSignalsLimit: fallbackPlan.runtimeSignalsPerMonth,
                 runtimeSignalsRemaining: null,
+                governedPassportsUsed: null,
+                governedPassportsLimit: fallbackPlan.maxGovernedPassports,
+                governedPassportsRemaining: null,
+                publishedModelPassports: [],
             };
             cachedCliAccountLimits = fallback;
             cachedCliAccountLimitsAt = now;
@@ -3027,6 +3108,21 @@ async function run() {
         const runtimeSignalsUsed = typeof summaryPayload?.usage?.runtimeSignals === 'number'
             ? summaryPayload.usage.runtimeSignals
             : null;
+        const governedPassportsUsed = typeof summaryPayload?.usage?.passports === 'number'
+            ? summaryPayload.usage.passports
+            : passports.length;
+        const governedPassportsLimit = summaryPayload?.planCapabilities?.governance?.maxGovernedPassports
+            ?? summaryPayload?.entitlements?.maxGovernedPassports
+            ?? fallback.maxGovernedPassports;
+        const publishedModelPassports = passports
+            .filter((passport) => String(passport.passportType || passport.passport_type || passport.type || '').toLowerCase() === 'model')
+            .map((passport) => ({
+            gaid: String(passport.gaid || '').trim(),
+            name: String(passport.name || 'Unnamed model passport').trim(),
+            workspaceId: String(passport.workspaceId || passport.workspace_id || '').trim() || null,
+            projectId: String(passport.projectId || passport.project_id || '').trim() || null,
+        }))
+            .filter((passport) => passport.gaid);
         const resolved = {
             displayName,
             planKey,
@@ -3047,6 +3143,10 @@ async function run() {
             runtimeSignalsUsed,
             runtimeSignalsLimit,
             runtimeSignalsRemaining: remainingFromLimit(runtimeSignalsLimit, runtimeSignalsUsed),
+            governedPassportsUsed,
+            governedPassportsLimit,
+            governedPassportsRemaining: remainingFromLimit(governedPassportsLimit, governedPassportsUsed),
+            publishedModelPassports,
         };
         cachedCliAccountLimits = resolved;
         cachedCliAccountLimitsAt = now;
@@ -3298,41 +3398,91 @@ async function run() {
                 return 'Draft creation is not active for this binding yet. Complete Connect approval or update consent on Forkit.dev first.';
             return raw;
         };
-        const runRegisterOne = async (targetModelName) => {
+        const normalizeRegisterSuccessMessage = (action) => {
+            if (action === 'already_bound')
+                return 'Model is already connected to an existing passport.';
+            if (action === 'already_pending')
+                return 'Model already has a pending draft. No duplicate draft created.';
+            if (action === 'passport_registered')
+                return 'Passport published successfully.';
+            if (action === 'draft_created')
+                return 'Draft created successfully.';
+            if (action === 'draft_queued')
+                return 'Draft queued locally and will sync when backend access is available.';
+            return action;
+        };
+        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const governedPassportCapacityFull = accountLimits
+            ? isCapacityExhausted(accountLimits.governedPassportsLimit, accountLimits.governedPassportsRemaining)
+            : false;
+        const buildCapacityPayload = (requestedModel) => ({
+            ok: false,
+            code: 'GOVERNED_PASSPORT_CAPACITY_REACHED',
+            requested_model: requestedModel ?? null,
+            plan: accountLimits?.planName ?? operatingMode.tier ?? null,
+            governed_passports_used: accountLimits?.governedPassportsUsed ?? null,
+            governed_passports_limit: accountLimits?.governedPassportsLimit ?? null,
+            message: 'This account has reached governed passport capacity. Forkit Connect will not create more governed drafts by default because publishing would be blocked.',
+            next_actions: [
+                'Use an existing published model passport for Runtime Signals C2 or run-log testing.',
+                'Free capacity or upgrade before publishing another governed model.',
+                'Use --draft-only if you intentionally want to save another draft for later review.',
+            ],
+            existing_model_passports: accountLimits?.publishedModelPassports.slice(0, 8) ?? [],
+        });
+        const runRegisterOne = async (targetModelSelector, displayNameHint) => {
             try {
-                const result = await service.connectDetectedModel(targetModelName);
+                const result = await service.connectDetectedModel(targetModelSelector);
                 return {
                     ok: true,
                     model: result.model.model,
+                    selector: result.model.discoveryHash,
                     draftId: result.draftId ?? null,
                     gaid: result.gaid ?? null,
-                    message: result.action,
+                    message: normalizeRegisterSuccessMessage(result.action),
+                    action: result.action,
                 };
             }
             catch (error) {
                 const rawMessage = error instanceof Error ? error.message : 'register_failed';
                 return {
                     ok: false,
-                    model: targetModelName,
+                    model: displayNameHint || targetModelSelector,
+                    selector: targetModelSelector,
                     message: normalizeRegisterErrorMessage(rawMessage),
                 };
             }
         };
         if (hasFlag('--all-ready')) {
+            if (governedPassportCapacityFull && !hasFlag('--draft-only')) {
+                printJson({
+                    ...buildCapacityPayload(null),
+                    attempted: 0,
+                    skipped: 'all-ready',
+                });
+                process.exitCode = 2;
+                return;
+            }
             const inbox = service.buildSmartRegistrationInbox();
-            const readyModels = inbox.groups.ready_to_connect
+            const readyModelCandidates = inbox.groups.ready_to_connect
                 .filter((item) => item.item_type === 'model' && item.recommended_action === 'create_passport_draft')
-                .map((item) => item.display_name);
-            if (readyModels.length === 0) {
+                .map((item) => ({
+                selector: extractInboxItemSelector(item),
+                model: item.display_name,
+            }))
+                .filter((item) => String(item.selector || '').trim())
+                .sort((left, right) => left.model.localeCompare(right.model) || left.selector.localeCompare(right.selector));
+            if (readyModelCandidates.length === 0) {
                 console.log('No ready local models need registration.');
                 return;
             }
             const results = [];
-            for (const item of readyModels) {
-                results.push(await runRegisterOne(item));
+            for (const item of readyModelCandidates) {
+                results.push(await runRegisterOne(item.selector, item.model));
             }
             printJson({
-                attempted: readyModels.length,
+                attempted: readyModelCandidates.length,
+                selectors: readyModelCandidates.map((item) => item.selector),
                 results,
             });
             if (results.some((item) => !item.ok)) {
@@ -3345,18 +3495,41 @@ async function run() {
             const readyModels = inbox.groups.ready_to_connect
                 .filter((item) => item.item_type === 'model')
                 .map((item) => item.display_name);
+            const readyModelSelectors = inbox.groups.ready_to_connect
+                .filter((item) => item.item_type === 'model')
+                .map((item) => ({
+                model: item.display_name,
+                selector: extractInboxItemSelector(item),
+            }))
+                .filter((item) => String(item.selector || '').trim())
+                .sort((left, right) => left.model.localeCompare(right.model) || left.selector.localeCompare(right.selector));
             printJson({
                 operating_mode: operatingMode.mode,
                 tier: operatingMode.tier,
                 workspace_id: boundWorkspaceId,
                 project_id: boundProjectId,
+                capacity: accountLimits ? {
+                    governed_passports_used: accountLimits.governedPassportsUsed,
+                    governed_passports_limit: accountLimits.governedPassportsLimit,
+                    governed_passports_remaining: accountLimits.governedPassportsRemaining,
+                    capacity_full: governedPassportCapacityFull,
+                } : null,
                 ready_models: readyModels,
+                ready_model_selectors: readyModelSelectors,
+                existing_model_passports: accountLimits?.publishedModelPassports.slice(0, 8) ?? [],
                 next: readyModels.length
-                    ? 'Run forkit-connect register --model "<name>" or forkit-connect register --all-ready'
+                    ? governedPassportCapacityFull
+                        ? 'Capacity is full. Use an existing passport for C2/run-log testing, free capacity, upgrade, or pass --draft-only if you intentionally want another draft.'
+                        : 'Run forkit-connect register --model "<name>" or forkit-connect register --all-ready'
                     : 'Run forkit-connect scan first or review forkit-connect inbox',
             });
             return;
         }
+        if (governedPassportCapacityFull && !hasFlag('--draft-only')) {
+            printJson(buildCapacityPayload(modelName));
+            process.exitCode = 2;
+            return;
+        }
         const result = await runRegisterOne(modelName);
         printJson(result);
         if (!result.ok) {
@@ -3408,7 +3581,7 @@ async function run() {
         return;
     }
     if (command === 'inbox') {
-        runPublicConnectInbox();
+        await runPublicConnectInbox();
         return;
     }
     if (command === 'start') {
@@ -3505,7 +3678,7 @@ async function run() {
             return;
         }
         if (subcommand === 'inbox') {
-            runPublicConnectInbox();
+            await runPublicConnectInbox();
             return;
         }
         if (subcommand === 'services') {
@@ -3650,6 +3823,54 @@ async function run() {
             }, null, 2));
             return;
         }
+        if (subcommand === 'run-log' && args[2] === 'emit') {
+            const gaid = getArg('--gaid') ?? getArg('--heartbeat-gaid');
+            const apiKey = getArg('--api-key') ?? getArg('--heartbeat-key') ?? process.env.FORKIT_RUNTIME_SIGNAL_API_KEY ?? null;
+            const provider = getArg('--provider');
+            const runModel = getArg('--model');
+            const serviceName = getArg('--service-name') ?? getArg('--name');
+            if (!gaid || !provider || !runModel || !serviceName) {
+                console.error('[forkit-connect] c2 run-log emit requires --gaid, --provider, --model, and --service-name.');
+                console.error('[forkit-connect] Provide an API key with --api-key, --heartbeat-key, FORKIT_RUNTIME_SIGNAL_API_KEY, or a stored c2 set-key entry.');
+                process.exitCode = 1;
+                return;
+            }
+            const result = await service.emitRuntimeRunLog({
+                gaid,
+                apiKey,
+                provider,
+                model: runModel,
+                serviceName,
+                serviceKind: getArg('--service-kind') ?? 'custom',
+                runId: getArg('--run-id'),
+                externalRunId: getArg('--external-run-id'),
+                status: getArg('--status') ?? 'completed',
+                startedAt: getArg('--started-at'),
+                endedAt: getArg('--ended-at'),
+                promptTokens: getNumericArg('--prompt-tokens'),
+                completionTokens: getNumericArg('--completion-tokens'),
+                cachedPromptTokens: getNumericArg('--cached-prompt-tokens'),
+                reasoningTokens: getNumericArg('--reasoning-tokens'),
+                latencyMs: getNumericArg('--latency-ms'),
+                estimatedCostCents: getNumericArg('--estimated-cost-cents'),
+                currency: getArg('--currency') ?? 'USD',
+                summary: getArg('--summary'),
+            });
+            if (!result.ok) {
+                console.error(`[forkit-connect] Runtime run log emit failed (${result.status || 'local'}).`);
+                if (result.body) {
+                    console.error(typeof result.body === 'string' ? result.body : JSON.stringify(result.body));
+                }
+                process.exitCode = 2;
+                return;
+            }
+            console.log(JSON.stringify({
+                accepted: true,
+                status: result.status,
+                response: result.body,
+            }, null, 2));
+            return;
+        }
         if (subcommand === 'sync') {
             const syncResult = await service.flushC2LifecycleEvents({
                 runtimeSignalApiKey: getArg('--heartbeat-key'),
@@ -4441,6 +4662,29 @@ async function run() {
             process.exitCode = 2;
             return;
         }
+        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const governedPassportCapacityFull = accountLimits
+            ? isCapacityExhausted(accountLimits.governedPassportsLimit, accountLimits.governedPassportsRemaining)
+            : false;
+        if (governedPassportCapacityFull && !hasFlag('--draft-only')) {
+            printJson({
+                ok: false,
+                code: 'GOVERNED_PASSPORT_CAPACITY_REACHED',
+                requested_model: modelName,
+                plan: accountLimits?.planName ?? null,
+                governed_passports_used: accountLimits?.governedPassportsUsed ?? null,
+                governed_passports_limit: accountLimits?.governedPassportsLimit ?? null,
+                message: 'This account has reached governed passport capacity. Forkit Connect will not create another governed draft by default because publishing would be blocked.',
+                next_actions: [
+                    'Use an existing published model passport for Runtime Signals C2 or run-log testing.',
+                    'Free capacity or upgrade before publishing another governed model.',
+                    'Use --draft-only if you intentionally want to save another draft for later review.',
+                ],
+                existing_model_passports: accountLimits?.publishedModelPassports.slice(0, 8) ?? [],
+            });
+            process.exitCode = 2;
+            return;
+        }
         const modelKey = `${model.model}#${model.digest}`;
         const existingBinding = (state.model_bindings || []).find((binding) => binding.modelKey === modelKey && binding.status !== 'ignored');
         if (existingBinding?.draftId) {