forkit-connect 0.1.0 → 0.1.3

package/dist/cli.js

@@ -38,6 +38,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: 0,
         maxWorkspaces: 0,
         maxProjects: 0,
+        maxGovernedPassports: 0,
         runtimeSignalsPerMonth: null,
     },
     signal: {
@@ -45,6 +46,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: 25,
         maxWorkspaces: 3,
         maxProjects: 3,
+        maxGovernedPassports: 3,
         runtimeSignalsPerMonth: 10000,
     },
     protocol: {
@@ -52,6 +54,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: 20,
         maxWorkspaces: null,
         maxProjects: null,
+        maxGovernedPassports: null,
         runtimeSignalsPerMonth: 250000,
     },
     sovereign: {
@@ -59,6 +62,7 @@ const CLI_FALLBACK_PLAN_LIMITS = {
         draftPassports: null,
         maxWorkspaces: null,
         maxProjects: null,
+        maxGovernedPassports: null,
         runtimeSignalsPerMonth: null,
     },
 };
@@ -74,6 +78,7 @@ const PUBLIC_COMMANDS = [
     ['inbox', 'Review the Smart Registration Inbox'],
     ['sync', 'Flush queued drafts and lifecycle metadata'],
     ['workspace', 'List, select, or inspect optional governed workspace/project scope'],
+    ['runtime', 'Review local runtime discovery and runtime health'],
     ['register', 'Register ready local models into the current scope'],
     ['ignore', 'Ignore one detected local model'],
     ['doctor', 'Run local environment diagnostics'],
@@ -101,11 +106,12 @@ const ADVANCED_COMMAND_GROUPS = [
     ['notify', 'Notification preview and delivery controls'],
 ];
 function usage() {
-    console.log('Usage: forkit-connect <init|login|logout|status|changes|start|stop|scan|inbox|sync|workspace|register|ignore|doctor> [options]');
+    console.log('Usage: forkit-connect <init|login|logout|status|changes|start|stop|scan|inbox|sync|workspace|runtime|register|ignore|doctor> [options]');
     console.log('       forkit-connect workspace <list|select|create|status> [options]');
+    console.log('       forkit-connect runtime <review|status> [options]');
     console.log('Public commands:');
     for (const [command, description] of PUBLIC_COMMANDS) {
-        console.log(`  ${command.padEnd(7)} ${description}`);
+        console.log(`  ${command.padEnd(10)} ${description}`);
     }
     console.log('Options:');
     console.log('  --description <text>    Optional workspace description used by workspace create');
@@ -151,6 +157,22 @@ function advancedUsage() {
     console.log('  --heartbeat-gaid <gaid> Queue heartbeat runtime signal event for GAID');
     console.log('  --heartbeat-key <key>   API key used for heartbeat runtime signal event');
     console.log('                          Also used by: c2 set-key (stores key + backfills events)');
+    console.log('  --gaid <gaid>           Passport GAID used by c2 run-log emit');
+    console.log('  --api-key <key>         Runtime signal API key used by c2 run-log emit');
+    console.log('  --provider <name>       Provider label used by c2 run-log emit');
+    console.log('  --service-name <name>   Service/agent/workflow label used by c2 run-log emit');
+    console.log('  --prompt-tokens <n>     Prompt tokens used by c2 run-log emit');
+    console.log('  --completion-tokens <n> Completion tokens used by c2 run-log emit');
+    console.log('  --client-name <name>    Optional repo/runtime client label used by c2 run-log emit');
+    console.log('  --actor-labels <csv>    Actor labels used by c2 run-log emit (for example: Codex,Claude)');
+    console.log('  --task-labels <csv>     Task or chat labels used by c2 run-log emit');
+    console.log('  --folder-labels <csv>   Relative folder labels used by c2 run-log emit');
+    console.log('  --file-labels <csv>     Relative file labels used by c2 run-log emit');
+    console.log('  --model-labels <csv>    Optional model labels used by c2 run-log emit');
+    console.log('  --cpu-percent <n>       Scoped CPU percentage used by c2 run-log emit');
+    console.log('  --memory-mb <n>         Scoped memory usage used by c2 run-log emit');
+    console.log('  --vram-mb <n>           Device VRAM usage used by c2 run-log emit');
+    console.log('  --draft-only            Allow draft creation even when governed publish capacity is full');
 }
 function showUsage() {
     if (hasFlag('--advanced-help')) {
@@ -169,6 +191,13 @@ function getArg(flag) {
 function hasFlag(flag) {
     return process.argv.slice(2).includes(flag);
 }
+function getNumericArg(flag) {
+    const value = getArg(flag);
+    if (value === null)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
 function isHelpCommand(command) {
     return command === 'help' || command === '--help' || command === '-h' || command === '--advanced-help';
 }
@@ -182,6 +211,20 @@ function sleep(ms) {
         delay(resolve, ms);
     });
 }
+async function withTimeout(promise, timeoutMs, fallbackValue) {
+    return new Promise((resolve) => {
+        const timeout = setTimeout(() => resolve(fallbackValue), Math.max(0, timeoutMs));
+        promise
+            .then((value) => {
+            clearTimeout(timeout);
+            resolve(value);
+        })
+            .catch(() => {
+            clearTimeout(timeout);
+            resolve(fallbackValue);
+        });
+    });
+}
 function isDeviceConnectStartResponse(body) {
     if (!body || typeof body !== 'object')
         return false;
@@ -220,12 +263,11 @@ function printDeviceLoginInstructions(start) {
     console.log('[forkit-connect] Keep this terminal open while Forkit Connect waits for approval.');
 }
 function printSessionExportFallback(token) {
+    void token;
     console.log('[forkit-connect] Approval succeeded, but secure credential storage is unavailable in this Linux session.');
     console.log('[forkit-connect] Forkit Connect can keep using this approved session in the current interactive run.');
-    console.log('[forkit-connect] To keep working in this terminal right now, export the session reference manually:');
-    console.log(`export FORKIT_CONNECT_SESSION_REF='${token}'`);
-    console.log('[forkit-connect] Then rerun: forkit-connect status');
-    console.log('[forkit-connect] For a persistent and safer setup, install libsecret-tools and run forkit-connect login again.');
+    console.log('[forkit-connect] For persistent login, install libsecret-tools and run forkit-connect login again.');
+    console.log('[forkit-connect] Headless automation may pass FORKIT_CONNECT_SESSION_REF explicitly, but Connect will not print session tokens.');
 }
 function hasLinuxGuiSession() {
     if (process.platform !== 'linux') {
@@ -300,6 +342,9 @@ function formatRemainingLimit(limit, used, singular, plural = `${singular}s`) {
     const remaining = Math.max(safeLimit - safeUsed, 0);
     return `${remaining} left (${safeUsed}/${safeLimit} used)`;
 }
+function isCapacityExhausted(limit, remaining) {
+    return Number.isFinite(limit) && Number(remaining) <= 0;
+}
 function formatWorkspaceAccessLine(workspace) {
     const workspaceId = String(workspace.id || workspace.gaid || workspace.passportGaid || 'unknown');
     return `- ${summarizeWorkspaceLabel(workspace)} | id=${workspaceId}`;
@@ -577,6 +622,11 @@ function printJson(value) {
     console.log(JSON.stringify(value, null, 2));
 }
 const INTERACTIVE_LABEL_WIDTH = 24;
+const INTERACTIVE_DISCOVERY_TIMEOUT_MS = 800;
+const INTERACTIVE_BINDING_TIMEOUT_MS = 800;
+const INTERACTIVE_ACCOUNT_LIMITS_TIMEOUT_MS = 700;
+const SESSION_STATE_CHECK_TIMEOUT_MS = 3000;
+const STATUS_BINDING_TIMEOUT_MS = 800;
 function canRenderInteractiveShell() {
     return Boolean(node_process_1.stdin.isTTY && node_process_1.stdout.isTTY);
 }
@@ -628,11 +678,8 @@ function shellListLine(value) {
     return `• ${value}`;
 }
 function buildInteractiveOverviewSections(service, sessionState, accountLimits) {
-    const overview = service.getConnectStatusOverview();
-    const inbox = service.buildSmartRegistrationInbox();
-    const leftoverReady = inbox.groups.ready_to_connect.slice(0, 4).map((item) => shellListLine(item.display_name));
-    const leftoverNeedsConfirmation = inbox.groups.needs_confirmation.slice(0, 4).map((item) => shellListLine(item.display_name));
-    const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+    const accountTrusted = sessionState === 'authorized';
+    const overview = service.getConnectStatusOverview({ includeInbox: false });
     const preparedWorkspace = accountTrusted ? String(overview.workspace_id || '').trim() : '';
     const preparedProject = accountTrusted ? String(overview.project_id || '').trim() : '';
     // Base section: always visible
@@ -673,6 +720,9 @@ function buildInteractiveOverviewSections(service, sessionState, accountLimits)
                 lines: [
                     shellLine('Plan', accountLimits.planName),
                     shellLine('Private passports', formatRemainingLimit(accountLimits.privatePassportsLimit, accountLimits.privatePassportsUsed, 'private passport')),
+                    ...(accountLimits.governedPassportsLimit !== null || accountLimits.governedPassportsUsed !== null
+                        ? [shellLine('Governed passports', formatRemainingLimit(accountLimits.governedPassportsLimit, accountLimits.governedPassportsUsed, 'governed passport'))]
+                        : []),
                     shellLine('Drafts', formatRemainingLimit(accountLimits.draftLimit, accountLimits.draftsUsed, 'draft')),
                     shellLine('Workspaces', formatRemainingLimit(accountLimits.workspaceLimit, accountLimits.workspacesUsed, 'workspace')),
                     shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
@@ -687,10 +737,8 @@ function buildInteractiveOverviewSections(service, sessionState, accountLimits)
             lines: [
                 shellLine('Workspace', formatScopeReferenceLabel(preparedWorkspace || null, 'workspace')),
                 shellLine('Project', formatScopeReferenceLabel(preparedProject || null, 'project')),
-                shellLine('Ready to connect', inbox.groups.ready_to_connect.length),
-                shellLine('Needs confirmation', inbox.groups.needs_confirmation.length),
-                ...leftoverReady,
-                ...leftoverNeedsConfirmation,
+                shellLine('Ready to connect', overview.ready_to_connect_count),
+                shellLine('Needs confirmation', overview.needs_confirmation_count),
             ],
         });
     }
@@ -1081,22 +1129,24 @@ function printAgentLedger(summary) {
     console.log(JSON.stringify(summary, null, 2));
 }
 function printRuntimeReview(summary) {
-    console.log(`[forkit-connect] Runtime review items=${summary.total_runtimes}`);
+    console.log('[forkit-connect] Runtime review');
+    console.log(`- runtimes=${summary.total_runtimes}`);
     for (const runtime of summary.runtimes) {
-        console.log(`- runtime=${runtime.runtime_name} | type=${runtime.runtime_type} | status=${runtime.status} | gaid=${shortId(runtime.runtime_gaid)} | linked_models=${runtime.linked_models_count} | linked_agents=${runtime.linked_agents_count} | health=${runtime.health_status} | next=${runtime.recommended_action}`);
+        console.log(`- ${runtime.runtime_name} | ${runtime.status} | linked models=${runtime.linked_models_count} | linked agents=${runtime.linked_agents_count} | health=${runtime.health_status} | next=${runtime.recommended_action}`);
     }
 }
 function printRuntimeStatus(status) {
-    console.log(JSON.stringify({
-        total_runtimes: status.total_runtimes,
-        online_runtimes: status.online_runtimes,
-        offline_runtimes: status.offline_runtimes,
-        linked_runtimes: status.linked_runtimes,
-        unlinked_runtimes: status.unlinked_runtimes,
-        unhealthy_runtimes: status.unhealthy_runtimes,
-        latest_runtime_lifecycle_event: status.latest_runtime_lifecycle_event,
-        c2_pending_count: status.c2_pending_count,
-    }, null, 2));
+    console.log('[forkit-connect] Runtime status');
+    console.log(`- total=${status.total_runtimes}`);
+    console.log(`- online=${status.online_runtimes}`);
+    console.log(`- offline=${status.offline_runtimes}`);
+    console.log(`- linked=${status.linked_runtimes}`);
+    console.log(`- unlinked=${status.unlinked_runtimes}`);
+    console.log(`- needs attention=${status.unhealthy_runtimes}`);
+    console.log(`- pending runtime sync=${status.c2_pending_count}`);
+    if (status.latest_runtime_lifecycle_event) {
+        console.log(`- latest event=${status.latest_runtime_lifecycle_event}`);
+    }
 }
 function formatSmartInboxActionValue(action, itemType, connectableModelName) {
     switch (action) {
@@ -1172,18 +1222,14 @@ function printConnectStatusOverview(status) {
 }
 function printPublicStatusOverview(status) {
     console.log('[forkit-connect] Status');
-    console.log(`- device_paired=${String(status.device_paired)}`);
-    console.log(`- workspace=${status.workspace_id || 'not selected'}`);
-    console.log(`- project=${status.project_id || 'not selected'}`);
+    console.log(`- device=${status.device_paired ? 'paired' : 'approval pending'}`);
+    console.log(`- scope=${status.workspace_id && status.project_id ? `${status.workspace_id} / ${status.project_id}` : 'not selected'}`);
     console.log(`- daemon=${status.daemon_status}`);
-    console.log(`- models_discovered=${status.models_discovered}`);
-    console.log(`- agents_discovered=${status.agents_discovered}`);
-    console.log(`- runtimes_discovered=${status.runtimes_discovered}`);
-    console.log(`- ready_to_connect=${status.ready_to_connect_count}`);
-    console.log(`- needs_confirmation=${status.needs_confirmation_count}`);
-    console.log(`- connected=${status.connected_count}`);
-    console.log(`- c2_sync_pending=${status.c2_sync_pending}`);
-    console.log(`- privacy_mode=${status.privacy_mode}`);
+    console.log(`- local inventory=models ${status.models_discovered} · agents ${status.agents_discovered} · runtimes ${status.runtimes_discovered}`);
+    console.log(`- review queue=ready ${status.ready_to_connect_count} · needs review ${status.needs_confirmation_count}`);
+    console.log(`- connected records=${status.connected_count}`);
+    console.log(`- pending runtime sync=${status.c2_sync_pending}`);
+    console.log(`- privacy=${status.privacy_mode}`);
     if (status.lifecycle_note) {
         console.log(`- note=${status.lifecycle_note}`);
     }
@@ -1192,6 +1238,14 @@ function printPublicStatusOverview(status) {
     }
 }
 function printPublicStatusGuidance(status, sessionState) {
+    const accountLabel = sessionState === 'authorized'
+        ? 'connected'
+        : sessionState === 'expired'
+            ? 'expired'
+            : sessionState === 'unavailable'
+                ? 'unverified'
+                : 'login required';
+    console.log(`- account=${accountLabel}`);
     if (sessionState === 'missing') {
         console.log('- note=Local discovery is working. Sign in next to pair this device with your Forkit.dev account.');
         console.log('- next=run forkit-connect login');
@@ -1227,7 +1281,9 @@ async function checkBackendSessionState(service) {
         baseUrl: DEFAULT_BASE_URL,
         sessionRef: sessionRefValue,
     });
-    const result = await api.getProfileAccess();
+    const result = await withTimeout(api.getProfileAccess(), SESSION_STATE_CHECK_TIMEOUT_MS, null);
+    if (!result)
+        return 'unavailable';
     if (result.ok)
         return 'authorized';
     if (result.status === 401 || result.status === 403)
@@ -1434,18 +1490,27 @@ async function run() {
     const runPublicConnectInit = () => {
         printConnectInit(service.initializeConnectIdentity());
     };
+    const withSmartInboxSnapshotCounts = (overview) => {
+        const inbox = service.getSmartRegistrationInbox({
+            preferSnapshot: true,
+            refreshInBackground: false,
+        });
+        return {
+            ...overview,
+            ready_to_connect_count: inbox.summary.ready_to_connect_count,
+            needs_confirmation_count: inbox.summary.needs_confirmation_count,
+            connected_count: inbox.summary.connected_count,
+            next_recommended_action: inbox.summary.next_recommended_action,
+        };
+    };
     const runPublicConnectStatus = async () => {
         const sessionState = await checkBackendSessionState(service);
+        const secureStorage = service.getCredentialStoreStatus();
         if (service.readSessionRef()) {
-            try {
-                await service.refreshEffectiveBinding();
-            }
-            catch {
-                // Status remains useful with the last local binding snapshot.
-            }
+            await withTimeout(service.refreshEffectiveBinding(), STATUS_BINDING_TIMEOUT_MS, undefined);
         }
-        const overview = service.getConnectStatusOverview();
-        const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+        const accountTrusted = sessionState === 'authorized';
+        const overview = withSmartInboxSnapshotCounts(service.getConnectStatusOverview({ includeInbox: false }));
         const localScopeCached = Boolean(String(overview.workspace_id || '').trim() || String(overview.project_id || '').trim());
         const displayOverview = accountTrusted
             ? overview
@@ -1466,23 +1531,45 @@ async function run() {
                 session_truth: accountTrusted ? 'account_verified_or_offline' : 'local_scope_cached_login_required',
                 local_scope_cached: !accountTrusted && localScopeCached,
                 binding_truth: accountTrusted ? 'account_binding_active' : 'account_login_required',
+                secure_storage: {
+                    backend: secureStorage.backend,
+                    available: secureStorage.available,
+                    plaintext_fallback_active: secureStorage.plaintextFallbackActive,
+                    legacy_plaintext_file_present: secureStorage.legacyPlaintextFilePresent,
+                    detail: secureStorage.detail,
+                },
             });
             return;
         }
         printPublicStatusOverview(displayOverview);
-        console.log(`- session=${sessionState}`);
-        console.log(`- binding_truth=${accountTrusted ? 'account_binding_active' : 'account_login_required'}`);
-        if (!accountTrusted && localScopeCached) {
-            console.log('- local_scope_cached=true');
+        console.log(`- secure storage=${secureStorage.backend}`);
+        if (!secureStorage.available || secureStorage.plaintextFallbackActive) {
+            console.log(`- secure storage detail=${secureStorage.detail}`);
         }
         printPublicStatusGuidance(displayOverview, sessionState);
     };
-    const runPublicConnectInbox = () => {
-        const inbox = service.buildSmartRegistrationInbox();
+    const runPublicConnectInbox = async () => {
+        const forceRefresh = hasFlag('--refresh');
+        const inbox = service.getSmartRegistrationInbox({
+            forceRefresh,
+            preferSnapshot: !forceRefresh,
+            refreshInBackground: !forceRefresh,
+        });
         if (hasFlag('--json')) {
             printJson(inbox);
             return;
         }
+        const freshness = inbox.summary.freshness_state ?? 'fresh';
+        const ageSeconds = Number.isFinite(inbox.summary.snapshot_age_seconds)
+            ? Number(inbox.summary.snapshot_age_seconds)
+            : 0;
+        console.log(`[forkit-connect] Inbox snapshot freshness=${freshness} age_seconds=${ageSeconds}`);
+        if (freshness === 'stale') {
+            console.log('[forkit-connect] Snapshot is stale. Run `forkit-connect inbox --refresh` for immediate reconcile.');
+        }
+        else if (freshness === 'syncing') {
+            console.log('[forkit-connect] Background reconcile is running; results will self-refresh after completion.');
+        }
         printSmartInbox(inbox);
     };
     const runPublicCollectedChanges = () => {
@@ -1571,10 +1658,11 @@ async function run() {
     const runPublicLogout = () => {
         const currentSessionRef = String(service.readSessionRef() || '').trim();
         const hadEnvironmentSession = Boolean(String(process.env.FORKIT_CONNECT_SESSION_REF || '').trim());
+        const logoutAt = new Date().toISOString();
         delete process.env.FORKIT_CONNECT_SESSION_REF;
         try {
             service.setSessionRef(null);
-            console.log('[forkit-connect] Logged out. Local discovery remains available on this device.');
+            console.log(`[forkit-connect] Logged out at ${logoutAt}. Local discovery remains available on this device.`);
             if (hadEnvironmentSession) {
                 console.log('[forkit-connect] The in-process fallback session was cleared for this run.');
             }
@@ -1583,12 +1671,12 @@ async function run() {
         catch (error) {
             if (error instanceof credential_store_1.ConnectCredentialStoreError) {
                 if (currentSessionRef) {
-                    console.log('[forkit-connect] Logged out from the current interactive run.');
+                    console.log(`[forkit-connect] Logged out from the current interactive run at ${logoutAt}.`);
                     console.log('[forkit-connect] If you previously exported a session in your shell, remove it there with:');
                     console.log('unset FORKIT_CONNECT_SESSION_REF');
                     return;
                 }
-                console.log('[forkit-connect] No stored session found.');
+                console.log(`[forkit-connect] No stored session found at ${logoutAt}.`);
                 console.log('[forkit-connect] If you previously exported a session in this shell, remove it with:');
                 console.log('unset FORKIT_CONNECT_SESSION_REF');
                 return;
@@ -1644,6 +1732,7 @@ async function run() {
                 try {
                     service.setSessionRef(polled.body.connect_access_token);
                     await service.refreshEffectiveBinding();
+                    await withTimeout(service.prewarmSmartRegistrationInbox(), 1800, undefined);
                     const displayName = getSessionDisplayName(polled.body.connect_access_token);
                     console.log(displayName
                         ? `[forkit-connect] Login approved. Welcome, ${displayName}. Session credentials stored securely.`
@@ -1653,6 +1742,7 @@ async function run() {
                 catch (error) {
                     if (error instanceof credential_store_1.ConnectCredentialStoreError) {
                         await activateEnvironmentSessionFallback(polled.body.connect_access_token);
+                        await withTimeout(service.prewarmSmartRegistrationInbox(), 1800, undefined);
                         printSessionExportFallback(polled.body.connect_access_token);
                         const displayName = getSessionDisplayName(polled.body.connect_access_token);
                         console.log(displayName
@@ -1709,16 +1799,11 @@ async function run() {
     const buildWorkspaceStatusPayload = async () => {
         const sessionState = await checkBackendSessionState(service);
         if (service.readSessionRef()) {
-            try {
-                await service.refreshEffectiveBinding();
-            }
-            catch {
-                // Keep local scope view available.
-            }
+            await withTimeout(service.refreshEffectiveBinding(), STATUS_BINDING_TIMEOUT_MS, undefined);
         }
-        const overview = service.getConnectStatusOverview();
         const operatingMode = resolveOperatingMode(service);
-        const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+        const accountTrusted = sessionState === 'authorized';
+        const overview = withSmartInboxSnapshotCounts(service.getConnectStatusOverview({ includeInbox: false }));
         const localScopeCached = Boolean(String(overview.workspace_id || '').trim() || String(overview.project_id || '').trim());
         return {
             session_state: sessionState,
@@ -1739,7 +1824,9 @@ async function run() {
         };
     };
     const renderInteractiveStatusScreen = async (sessionState) => {
-        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const accountLimits = node_process_1.stdin.isTTY && node_process_1.stdout.isTTY
+            ? await withTimeout(loadCliAccountLimits().catch(() => null), INTERACTIVE_ACCOUNT_LIMITS_TIMEOUT_MS, null)
+            : null;
         const displayName = accountLimits?.displayName ?? getSessionDisplayName(service.readSessionRef());
         renderInteractiveScreen('Forkit Connect', {
             subtitle: displayName ? `Welcome back, ${displayName}` : 'Interactive overview',
@@ -1788,18 +1875,8 @@ async function run() {
         // Only run discovery and binding refresh when the user has a session.
         // Pre-login, these calls add significant startup latency with no user benefit.
         if (service.readSessionRef()) {
-            try {
-                await service.runDiscoveryCycle();
-            }
-            catch {
-                // Keep the interactive shell usable even if local discovery has transient issues.
-            }
-            try {
-                await service.refreshEffectiveBinding();
-            }
-            catch {
-                // Use the latest local binding snapshot when backend refresh is unavailable.
-            }
+            await withTimeout(service.runDiscoveryCycle(), INTERACTIVE_DISCOVERY_TIMEOUT_MS, undefined);
+            await withTimeout(service.refreshEffectiveBinding(), INTERACTIVE_BINDING_TIMEOUT_MS, undefined);
         }
     };
     const runInteractiveWorkspaceMenu = async () => {
@@ -2394,7 +2471,10 @@ async function run() {
         }
     };
     const buildInteractiveRegisterCandidates = () => {
-        const inbox = service.buildSmartRegistrationInbox();
+        const inbox = service.getSmartRegistrationInbox({
+            preferSnapshot: true,
+            refreshInBackground: true,
+        });
         const candidates = new Map();
         const groups = ['needs_confirmation', 'ready_to_connect'];
         const state = service.getStateStore().readState();
@@ -2654,7 +2734,10 @@ async function run() {
         await runInteractiveAutoRefresh();
         const groupOrder = ['needs_confirmation', 'ready_to_connect', 'connected', 'ignored'];
         while (true) {
-            const inbox = service.buildSmartRegistrationInbox();
+            const inbox = service.getSmartRegistrationInbox({
+                preferSnapshot: true,
+                refreshInBackground: true,
+            });
             const entries = groupOrder.flatMap((group) => inbox.groups[group].map((item) => ({ group, item })));
             if (entries.length === 0) {
                 renderInteractiveScreen('Smart Registration Inbox', {
@@ -2669,7 +2752,7 @@ async function run() {
                 return;
             }
             renderInteractiveScreen('Smart Registration Inbox', {
-                subtitle: `Generated at ${inbox.summary.generated_at}`,
+                subtitle: `Generated at ${inbox.summary.generated_at} · freshness=${inbox.summary.freshness_state ?? 'fresh'}`,
                 sections: buildInteractiveInboxSections(inbox),
                 footerLines: ['Choose an inbox item below.'],
             });
@@ -2704,11 +2787,15 @@ async function run() {
         }
     };
     const runInteractiveStart = async () => {
+        if (!node_process_1.stdin.isTTY || !node_process_1.stdout.isTTY) {
+            const sessionState = service.readSessionRef() ? 'unavailable' : 'missing';
+            await renderInteractiveStatusScreen(sessionState);
+            return;
+        }
         while (true) {
             process.exitCode = 0;
-            await runInteractiveAutoRefresh();
             const sessionState = await checkBackendSessionState(service);
-            const authenticated = sessionState === 'authorized' || (sessionState === 'unavailable' && Boolean(service.readSessionRef()));
+            const authenticated = sessionState === 'authorized';
             if (!authenticated) {
                 await renderInteractiveStatusScreen(sessionState);
                 const selected = await promptSelection('Choose an action', [
@@ -2765,6 +2852,8 @@ async function run() {
                 { value: 'exit', label: 'Exit' },
             ]);
             if (!selected || selected === 'exit') {
+                const exitAt = new Date().toISOString();
+                console.log(`[forkit-connect] Quit at ${exitAt}. Interactive work stopped for this device; use logout if you want to clear the session reference.`);
                 return;
             }
             if (selected === 'status') {
@@ -2964,6 +3053,10 @@ async function run() {
                 runtimeSignalsUsed: null,
                 runtimeSignalsLimit: fallbackPlan.runtimeSignalsPerMonth,
                 runtimeSignalsRemaining: null,
+                governedPassportsUsed: null,
+                governedPassportsLimit: fallbackPlan.maxGovernedPassports,
+                governedPassportsRemaining: null,
+                publishedModelPassports: [],
             };
             cachedCliAccountLimits = fallback;
             cachedCliAccountLimitsAt = now;
@@ -3027,6 +3120,21 @@ async function run() {
         const runtimeSignalsUsed = typeof summaryPayload?.usage?.runtimeSignals === 'number'
             ? summaryPayload.usage.runtimeSignals
             : null;
+        const governedPassportsUsed = typeof summaryPayload?.usage?.passports === 'number'
+            ? summaryPayload.usage.passports
+            : passports.length;
+        const governedPassportsLimit = summaryPayload?.planCapabilities?.governance?.maxGovernedPassports
+            ?? summaryPayload?.entitlements?.maxGovernedPassports
+            ?? fallback.maxGovernedPassports;
+        const publishedModelPassports = passports
+            .filter((passport) => String(passport.passportType || passport.passport_type || passport.type || '').toLowerCase() === 'model')
+            .map((passport) => ({
+            gaid: String(passport.gaid || '').trim(),
+            name: String(passport.name || 'Unnamed model passport').trim(),
+            workspaceId: String(passport.workspaceId || passport.workspace_id || '').trim() || null,
+            projectId: String(passport.projectId || passport.project_id || '').trim() || null,
+        }))
+            .filter((passport) => passport.gaid);
         const resolved = {
             displayName,
             planKey,
@@ -3047,6 +3155,10 @@ async function run() {
             runtimeSignalsUsed,
             runtimeSignalsLimit,
             runtimeSignalsRemaining: remainingFromLimit(runtimeSignalsLimit, runtimeSignalsUsed),
+            governedPassportsUsed,
+            governedPassportsLimit,
+            governedPassportsRemaining: remainingFromLimit(governedPassportsLimit, governedPassportsUsed),
+            publishedModelPassports,
         };
         cachedCliAccountLimits = resolved;
         cachedCliAccountLimitsAt = now;
@@ -3298,41 +3410,91 @@ async function run() {
                 return 'Draft creation is not active for this binding yet. Complete Connect approval or update consent on Forkit.dev first.';
             return raw;
         };
-        const runRegisterOne = async (targetModelName) => {
+        const normalizeRegisterSuccessMessage = (action) => {
+            if (action === 'already_bound')
+                return 'Model is already connected to an existing passport.';
+            if (action === 'already_pending')
+                return 'Model already has a pending draft. No duplicate draft created.';
+            if (action === 'passport_registered')
+                return 'Passport published successfully.';
+            if (action === 'draft_created')
+                return 'Draft created successfully.';
+            if (action === 'draft_queued')
+                return 'Draft queued locally and will sync when backend access is available.';
+            return action;
+        };
+        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const governedPassportCapacityFull = accountLimits
+            ? isCapacityExhausted(accountLimits.governedPassportsLimit, accountLimits.governedPassportsRemaining)
+            : false;
+        const buildCapacityPayload = (requestedModel) => ({
+            ok: false,
+            code: 'GOVERNED_PASSPORT_CAPACITY_REACHED',
+            requested_model: requestedModel ?? null,
+            plan: accountLimits?.planName ?? operatingMode.tier ?? null,
+            governed_passports_used: accountLimits?.governedPassportsUsed ?? null,
+            governed_passports_limit: accountLimits?.governedPassportsLimit ?? null,
+            message: 'This account has reached governed passport capacity. Forkit Connect will not create more governed drafts by default because publishing would be blocked.',
+            next_actions: [
+                'Use an existing published model passport for Runtime Signals C2 or run-log testing.',
+                'Free capacity or upgrade before publishing another governed model.',
+                'Use --draft-only if you intentionally want to save another draft for later review.',
+            ],
+            existing_model_passports: accountLimits?.publishedModelPassports.slice(0, 8) ?? [],
+        });
+        const runRegisterOne = async (targetModelSelector, displayNameHint) => {
             try {
-                const result = await service.connectDetectedModel(targetModelName);
+                const result = await service.connectDetectedModel(targetModelSelector);
                 return {
                     ok: true,
                     model: result.model.model,
+                    selector: result.model.discoveryHash,
                     draftId: result.draftId ?? null,
                     gaid: result.gaid ?? null,
-                    message: result.action,
+                    message: normalizeRegisterSuccessMessage(result.action),
+                    action: result.action,
                 };
             }
             catch (error) {
                 const rawMessage = error instanceof Error ? error.message : 'register_failed';
                 return {
                     ok: false,
-                    model: targetModelName,
+                    model: displayNameHint || targetModelSelector,
+                    selector: targetModelSelector,
                     message: normalizeRegisterErrorMessage(rawMessage),
                 };
             }
         };
         if (hasFlag('--all-ready')) {
+            if (governedPassportCapacityFull && !hasFlag('--draft-only')) {
+                printJson({
+                    ...buildCapacityPayload(null),
+                    attempted: 0,
+                    skipped: 'all-ready',
+                });
+                process.exitCode = 2;
+                return;
+            }
             const inbox = service.buildSmartRegistrationInbox();
-            const readyModels = inbox.groups.ready_to_connect
+            const readyModelCandidates = inbox.groups.ready_to_connect
                 .filter((item) => item.item_type === 'model' && item.recommended_action === 'create_passport_draft')
-                .map((item) => item.display_name);
-            if (readyModels.length === 0) {
+                .map((item) => ({
+                selector: extractInboxItemSelector(item),
+                model: item.display_name,
+            }))
+                .filter((item) => String(item.selector || '').trim())
+                .sort((left, right) => left.model.localeCompare(right.model) || left.selector.localeCompare(right.selector));
+            if (readyModelCandidates.length === 0) {
                 console.log('No ready local models need registration.');
                 return;
             }
             const results = [];
-            for (const item of readyModels) {
-                results.push(await runRegisterOne(item));
+            for (const item of readyModelCandidates) {
+                results.push(await runRegisterOne(item.selector, item.model));
             }
             printJson({
-                attempted: readyModels.length,
+                attempted: readyModelCandidates.length,
+                selectors: readyModelCandidates.map((item) => item.selector),
                 results,
             });
             if (results.some((item) => !item.ok)) {
@@ -3345,18 +3507,41 @@ async function run() {
             const readyModels = inbox.groups.ready_to_connect
                 .filter((item) => item.item_type === 'model')
                 .map((item) => item.display_name);
+            const readyModelSelectors = inbox.groups.ready_to_connect
+                .filter((item) => item.item_type === 'model')
+                .map((item) => ({
+                model: item.display_name,
+                selector: extractInboxItemSelector(item),
+            }))
+                .filter((item) => String(item.selector || '').trim())
+                .sort((left, right) => left.model.localeCompare(right.model) || left.selector.localeCompare(right.selector));
             printJson({
                 operating_mode: operatingMode.mode,
                 tier: operatingMode.tier,
                 workspace_id: boundWorkspaceId,
                 project_id: boundProjectId,
+                capacity: accountLimits ? {
+                    governed_passports_used: accountLimits.governedPassportsUsed,
+                    governed_passports_limit: accountLimits.governedPassportsLimit,
+                    governed_passports_remaining: accountLimits.governedPassportsRemaining,
+                    capacity_full: governedPassportCapacityFull,
+                } : null,
                 ready_models: readyModels,
+                ready_model_selectors: readyModelSelectors,
+                existing_model_passports: accountLimits?.publishedModelPassports.slice(0, 8) ?? [],
                 next: readyModels.length
-                    ? 'Run forkit-connect register --model "<name>" or forkit-connect register --all-ready'
+                    ? governedPassportCapacityFull
+                        ? 'Capacity is full. Use an existing passport for C2/run-log testing, free capacity, upgrade, or pass --draft-only if you intentionally want another draft.'
+                        : 'Run forkit-connect register --model "<name>" or forkit-connect register --all-ready'
                     : 'Run forkit-connect scan first or review forkit-connect inbox',
             });
             return;
         }
+        if (governedPassportCapacityFull && !hasFlag('--draft-only')) {
+            printJson(buildCapacityPayload(modelName));
+            process.exitCode = 2;
+            return;
+        }
         const result = await runRegisterOne(modelName);
         printJson(result);
         if (!result.ok) {
@@ -3408,7 +3593,7 @@ async function run() {
         return;
     }
     if (command === 'inbox') {
-        runPublicConnectInbox();
+        await runPublicConnectInbox();
         return;
     }
     if (command === 'start') {
@@ -3423,6 +3608,30 @@ async function run() {
         await runPublicSync();
         return;
     }
+    if (command === 'runtime') {
+        const subcommand = args[1] || 'review';
+        if (subcommand === 'review') {
+            const summary = service.getRuntimePassportReview();
+            if (hasFlag('--json')) {
+                printJson(summary);
+                return;
+            }
+            printRuntimeReview(summary);
+            return;
+        }
+        if (subcommand === 'status') {
+            const status = service.getRuntimePassportStatus();
+            if (hasFlag('--json')) {
+                printJson(status);
+                return;
+            }
+            printRuntimeStatus(status);
+            return;
+        }
+        console.error('Usage: forkit-connect runtime <review|status>');
+        process.exitCode = 2;
+        return;
+    }
     if (command === 'workspace') {
         const subcommand = args[1] || 'status';
         try {
@@ -3505,7 +3714,7 @@ async function run() {
             return;
         }
         if (subcommand === 'inbox') {
-            runPublicConnectInbox();
+            await runPublicConnectInbox();
             return;
         }
         if (subcommand === 'services') {
@@ -3530,12 +3739,23 @@ async function run() {
             return;
         }
         if (subcommand === 'runtime') {
-            if (args[2] === 'review') {
-                printRuntimeReview(service.getRuntimePassportReview());
+            const runtimeSubcommand = args[2] || 'review';
+            if (runtimeSubcommand === 'review') {
+                const summary = service.getRuntimePassportReview();
+                if (hasFlag('--json')) {
+                    printJson(summary);
+                    return;
+                }
+                printRuntimeReview(summary);
                 return;
             }
-            if (args[2] === 'status') {
-                printRuntimeStatus(service.getRuntimePassportStatus());
+            if (runtimeSubcommand === 'status') {
+                const status = service.getRuntimePassportStatus();
+                if (hasFlag('--json')) {
+                    printJson(status);
+                    return;
+                }
+                printRuntimeStatus(status);
                 return;
             }
             console.error('Usage: forkit-connect connect runtime <review|status>');
@@ -3650,6 +3870,54 @@ async function run() {
             }, null, 2));
             return;
         }
+        if (subcommand === 'run-log' && args[2] === 'emit') {
+            const gaid = getArg('--gaid') ?? getArg('--heartbeat-gaid');
+            const apiKey = getArg('--api-key') ?? getArg('--heartbeat-key') ?? process.env.FORKIT_RUNTIME_SIGNAL_API_KEY ?? null;
+            const provider = getArg('--provider');
+            const runModel = getArg('--model');
+            const serviceName = getArg('--service-name') ?? getArg('--name');
+            if (!gaid || !provider || !runModel || !serviceName) {
+                console.error('[forkit-connect] c2 run-log emit requires --gaid, --provider, --model, and --service-name.');
+                console.error('[forkit-connect] Provide an API key with --api-key, --heartbeat-key, FORKIT_RUNTIME_SIGNAL_API_KEY, or a stored c2 set-key entry.');
+                process.exitCode = 1;
+                return;
+            }
+            const result = await service.emitRuntimeRunLog({
+                gaid,
+                apiKey,
+                provider,
+                model: runModel,
+                serviceName,
+                serviceKind: getArg('--service-kind') ?? 'custom',
+                runId: getArg('--run-id'),
+                externalRunId: getArg('--external-run-id'),
+                status: getArg('--status') ?? 'completed',
+                startedAt: getArg('--started-at'),
+                endedAt: getArg('--ended-at'),
+                promptTokens: getNumericArg('--prompt-tokens'),
+                completionTokens: getNumericArg('--completion-tokens'),
+                cachedPromptTokens: getNumericArg('--cached-prompt-tokens'),
+                reasoningTokens: getNumericArg('--reasoning-tokens'),
+                latencyMs: getNumericArg('--latency-ms'),
+                estimatedCostCents: getNumericArg('--estimated-cost-cents'),
+                currency: getArg('--currency') ?? 'USD',
+                summary: getArg('--summary'),
+            });
+            if (!result.ok) {
+                console.error(`[forkit-connect] Runtime run log emit failed (${result.status || 'local'}).`);
+                if (result.body) {
+                    console.error(typeof result.body === 'string' ? result.body : JSON.stringify(result.body));
+                }
+                process.exitCode = 2;
+                return;
+            }
+            console.log(JSON.stringify({
+                accepted: true,
+                status: result.status,
+                response: result.body,
+            }, null, 2));
+            return;
+        }
         if (subcommand === 'sync') {
             const syncResult = await service.flushC2LifecycleEvents({
                 runtimeSignalApiKey: getArg('--heartbeat-key'),
@@ -4441,6 +4709,29 @@ async function run() {
             process.exitCode = 2;
             return;
         }
+        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const governedPassportCapacityFull = accountLimits
+            ? isCapacityExhausted(accountLimits.governedPassportsLimit, accountLimits.governedPassportsRemaining)
+            : false;
+        if (governedPassportCapacityFull && !hasFlag('--draft-only')) {
+            printJson({
+                ok: false,
+                code: 'GOVERNED_PASSPORT_CAPACITY_REACHED',
+                requested_model: modelName,
+                plan: accountLimits?.planName ?? null,
+                governed_passports_used: accountLimits?.governedPassportsUsed ?? null,
+                governed_passports_limit: accountLimits?.governedPassportsLimit ?? null,
+                message: 'This account has reached governed passport capacity. Forkit Connect will not create another governed draft by default because publishing would be blocked.',
+                next_actions: [
+                    'Use an existing published model passport for Runtime Signals C2 or run-log testing.',
+                    'Free capacity or upgrade before publishing another governed model.',
+                    'Use --draft-only if you intentionally want to save another draft for later review.',
+                ],
+                existing_model_passports: accountLimits?.publishedModelPassports.slice(0, 8) ?? [],
+            });
+            process.exitCode = 2;
+            return;
+        }
         const modelKey = `${model.model}#${model.digest}`;
         const existingBinding = (state.model_bindings || []).find((binding) => binding.modelKey === modelKey && binding.status !== 'ignored');
         if (existingBinding?.draftId) {