forkit-connect 0.1.0

package/dist/cli.js

@@ -0,0 +1,4724 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_child_process_1 = require("node:child_process");
+const node_readline_1 = require("node:readline");
+const promises_1 = require("node:readline/promises");
+const node_process_1 = require("node:process");
+const daemon_1 = require("./v1/daemon");
+const service_1 = require("./v1/service");
+const discovery_1 = require("./v1/discovery");
+const heartbeat_1 = require("./v1/heartbeat");
+const update_1 = require("./v1/update");
+const api_1 = require("./v1/api");
+const credential_store_1 = require("./v1/credential-store");
+const DEFAULT_BASE_URL = process.env.FORKIT_API_URL ?? process.env.FORKIT_BASE_URL ?? 'https://www.forkit.dev';
+const TRAIN_EVENT_TYPES = [
+    'training_started',
+    'fine_tuning_started',
+    'checkpoint_created',
+    'evaluation_logged',
+    'training_completed',
+    'artifact_ready',
+    'version_created',
+    'draft_published',
+    'build_aborted',
+];
+const TRAIN_DATASET_CHANGE_TYPES = [
+    'initial_dataset',
+    'fine_tuning_dataset',
+    'validation_dataset',
+    'test_dataset',
+    'dataset_removed',
+    'dataset_updated',
+];
+const CLI_FALLBACK_PLAN_LIMITS = {
+    origin: {
+        privatePassports: 0,
+        draftPassports: 0,
+        maxWorkspaces: 0,
+        maxProjects: 0,
+        runtimeSignalsPerMonth: null,
+    },
+    signal: {
+        privatePassports: 25,
+        draftPassports: 25,
+        maxWorkspaces: 3,
+        maxProjects: 3,
+        runtimeSignalsPerMonth: 10000,
+    },
+    protocol: {
+        privatePassports: 20,
+        draftPassports: 20,
+        maxWorkspaces: null,
+        maxProjects: null,
+        runtimeSignalsPerMonth: 250000,
+    },
+    sovereign: {
+        privatePassports: null,
+        draftPassports: null,
+        maxWorkspaces: null,
+        maxProjects: null,
+        runtimeSignalsPerMonth: null,
+    },
+};
+const PUBLIC_COMMANDS = [
+    ['init', 'Initialize local Connect identity and privacy posture'],
+    ['login', 'Link this device to your Forkit.dev account'],
+    ['logout', 'Remove the stored Forkit.dev session from this device'],
+    ['status', 'Show account, scope, daemon, and queue status'],
+    ['changes', 'View all collected local changes and queued sync items'],
+    ['start', 'Open the interactive launcher or start foreground sync'],
+    ['stop', 'Stop the local Connect daemon'],
+    ['scan', 'Discover runtimes, models, and agents on this device'],
+    ['inbox', 'Review the Smart Registration Inbox'],
+    ['sync', 'Flush queued drafts and lifecycle metadata'],
+    ['workspace', 'List, select, or inspect optional governed workspace/project scope'],
+    ['register', 'Register ready local models into the current scope'],
+    ['ignore', 'Ignore one detected local model'],
+    ['doctor', 'Run local environment diagnostics'],
+];
+const ADVANCED_COMMAND_GROUPS = [
+    ['connect', 'Model connection, runtime review, and handoff utilities'],
+    ['review', 'Summarize discovered but unconnected items'],
+    ['doctor', 'Run local environment diagnostics'],
+    ['workspaces', 'List accessible workspaces after sign-in'],
+    ['projects', 'List projects for a workspace'],
+    ['bind', 'Bind the local device to a workspace and project'],
+    ['register', 'Create a Passport draft for a detected model'],
+    ['drafts', 'List backend Passport drafts'],
+    ['publish', 'Publish a Passport draft'],
+    ['bound', 'Inspect bound Passport models'],
+    ['heartbeat', 'Send a runtime heartbeat for a bound Passport'],
+    ['update-check', 'Check release metadata without auto-updating'],
+    ['config', 'Inspect or set local Connect config'],
+    ['daemon', 'Advanced daemon controls'],
+    ['pulse', 'Inspect best-effort local runtime signals'],
+    ['c2', 'Metadata-only lifecycle sync utilities'],
+    ['train', 'Training lifecycle evidence commands'],
+    ['agent', 'Agent review, link, and runtime signal utilities'],
+    ['tray', 'Tray/status surface helpers'],
+    ['notify', 'Notification preview and delivery controls'],
+];
+function usage() {
+    console.log('Usage: forkit-connect <init|login|logout|status|changes|start|stop|scan|inbox|sync|workspace|register|ignore|doctor> [options]');
+    console.log('       forkit-connect workspace <list|select|create|status> [options]');
+    console.log('Public commands:');
+    for (const [command, description] of PUBLIC_COMMANDS) {
+        console.log(`  ${command.padEnd(7)} ${description}`);
+    }
+    console.log('Options:');
+    console.log('  --description <text>    Optional workspace description used by workspace create');
+    console.log('  --project-name <text>   Project name used by workspace create/select');
+    console.log('  --project-description <text> Optional project description used by workspace create/select');
+    console.log('  --json                  Print machine-readable output when supported');
+    console.log('  --model <value>         Model name used by register');
+    console.log('  --all-ready             Register every ready local model in the current scope');
+    console.log('  --ignore-model <name>   Ignore detected model by name with --ignore-digest');
+    console.log('  --ignore-digest <sha>   Digest used with --ignore-model');
+    console.log('  --digest <sha>          Digest used by ignore when the model name is ambiguous');
+    console.log('  --interval-seconds <n>  Override daemon scan interval');
+    console.log('  --no-browser            Do not auto-open verification URL during login');
+    console.log('  --advanced-help         Show internal/engineering commands');
+}
+function advancedUsage() {
+    usage();
+    console.log('');
+    console.log('Advanced commands:');
+    console.log('  forkit-connect connect <modelNameOrDiscoveryHash>');
+    console.log('  forkit-connect connect <start|init|status|inbox|services|permissions|handoff|evolution review|runtime review|runtime status>');
+    console.log('  forkit-connect <review|workspaces|projects|bind|drafts|publish|bound|heartbeat|update-check|config|daemon|pulse|c2|train|agent|tray|notify> [options]');
+    for (const [command, description] of ADVANCED_COMMAND_GROUPS) {
+        console.log(`  ${command.padEnd(12)} ${description}`);
+    }
+    console.log('Advanced options:');
+    console.log('  --session-ref <value>   Store/update backend session reference');
+    console.log('  --workspace <id>        Store workspace binding');
+    console.log('  --project <id>          Store project binding');
+    console.log('  --draft <id>            Draft id used by publish');
+    console.log('  --name <value>          Model or metric name depending on command');
+    console.log('  --framework <value>     Training framework used by train init');
+    console.log('  --task <value>          Training task used by train init');
+    console.log('  --dataset-ref <value>   Safe dataset reference used by train init');
+    console.log('  --type <value>          Training lifecycle event type');
+    console.log('  --ref <value>           Dataset reference used by train dataset');
+    console.log('  --change <value>        Dataset change type used by train dataset');
+    console.log('  --value <number>        Metric value used by train metric');
+    console.log('  --version <value>       Version name used by train version');
+    console.log('  --reason <value>        Version or lifecycle reason');
+    console.log('  --path <value>          Artifact path used by train artifact');
+    console.log('  --hash-artifact         Hash artifact contents for train artifact');
+    console.log('  --heartbeat-gaid <gaid> Queue heartbeat runtime signal event for GAID');
+    console.log('  --heartbeat-key <key>   API key used for heartbeat runtime signal event');
+    console.log('                          Also used by: c2 set-key (stores key + backfills events)');
+}
+function showUsage() {
+    if (hasFlag('--advanced-help')) {
+        advancedUsage();
+        return;
+    }
+    usage();
+}
+function getArg(flag) {
+    const args = process.argv.slice(2);
+    const index = args.indexOf(flag);
+    if (index < 0)
+        return null;
+    return args[index + 1] ?? null;
+}
+function hasFlag(flag) {
+    return process.argv.slice(2).includes(flag);
+}
+function isHelpCommand(command) {
+    return command === 'help' || command === '--help' || command === '-h' || command === '--advanced-help';
+}
+function sleep(ms) {
+    return new Promise((resolve) => {
+        const delay = globalThis['set' + 'Timeout'];
+        if (typeof delay !== 'function') {
+            resolve();
+            return;
+        }
+        delay(resolve, ms);
+    });
+}
+function isDeviceConnectStartResponse(body) {
+    if (!body || typeof body !== 'object')
+        return false;
+    const value = body;
+    return (typeof value.device_code === 'string' &&
+        typeof value.user_code === 'string' &&
+        typeof value.verification_url === 'string' &&
+        typeof value.expires_at === 'string' &&
+        typeof value.poll_interval_seconds === 'number');
+}
+function isPollPending(body) {
+    return !!body && typeof body === 'object' && body.status === 'pending';
+}
+function isPollApproved(body) {
+    if (!body || typeof body !== 'object')
+        return false;
+    const value = body;
+    return value.status === 'approved' && typeof value.connect_access_token === 'string';
+}
+function openUrl(url) {
+    return new Promise((resolve) => {
+        if (process.platform === 'win32') {
+            (0, node_child_process_1.exec)(`cmd /c start "" ${JSON.stringify(url)}`, (error) => resolve(!error));
+            return;
+        }
+        const opener = process.platform === 'darwin' ? 'open' : 'xdg-open';
+        (0, node_child_process_1.exec)(`${opener} ${JSON.stringify(url)}`, (error) => resolve(!error));
+    });
+}
+function printDeviceLoginInstructions(start) {
+    console.log('[forkit-connect] Browser approval required.');
+    console.log(`[forkit-connect] User code: ${start.user_code}`);
+    console.log('[forkit-connect] Open this URL in your browser:');
+    console.log(start.verification_url);
+    console.log(`[forkit-connect] Expires at: ${start.expires_at}`);
+    console.log('[forkit-connect] Keep this terminal open while Forkit Connect waits for approval.');
+}
+function printSessionExportFallback(token) {
+    console.log('[forkit-connect] Approval succeeded, but secure credential storage is unavailable in this Linux session.');
+    console.log('[forkit-connect] Forkit Connect can keep using this approved session in the current interactive run.');
+    console.log('[forkit-connect] To keep working in this terminal right now, export the session reference manually:');
+    console.log(`export FORKIT_CONNECT_SESSION_REF='${token}'`);
+    console.log('[forkit-connect] Then rerun: forkit-connect status');
+    console.log('[forkit-connect] For a persistent and safer setup, install libsecret-tools and run forkit-connect login again.');
+}
+function hasLinuxGuiSession() {
+    if (process.platform !== 'linux') {
+        return true;
+    }
+    return Boolean(String(process.env.DISPLAY || '').trim()
+        || String(process.env.WAYLAND_DISPLAY || '').trim()
+        || String(process.env.MIR_SOCKET || '').trim());
+}
+function parseJwtPayload(token) {
+    const raw = String(token || '').trim();
+    const parts = raw.split('.');
+    if (parts.length !== 3) {
+        return null;
+    }
+    try {
+        const json = Buffer.from(parts[1] || '', 'base64url').toString('utf8');
+        const payload = JSON.parse(json);
+        return payload && typeof payload === 'object' ? payload : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isProfileAccessResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function isProductSummaryResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function resolveCliPlanKey(...values) {
+    for (const value of values) {
+        const normalized = String(value || '').trim().toLowerCase().replace(/[^a-z0-9]/g, '');
+        if (!normalized)
+            continue;
+        if (['origin', 'free', 'starter', 'launch'].includes(normalized))
+            return 'origin';
+        if (['signal', 'solo', 'singlepro', 'pro'].includes(normalized))
+            return 'signal';
+        if (['protocol', 'team', 'business'].includes(normalized))
+            return 'protocol';
+        if (['sovereign', 'enterprise'].includes(normalized))
+            return 'sovereign';
+    }
+    return 'origin';
+}
+function getCliPlanName(planKey) {
+    switch (planKey) {
+        case 'signal':
+            return 'Signal';
+        case 'protocol':
+            return 'Protocol';
+        case 'sovereign':
+            return 'Sovereign';
+        default:
+            return 'Origin';
+    }
+}
+function remainingFromLimit(limit, used) {
+    if (!Number.isFinite(limit))
+        return null;
+    const safeLimit = Number(limit);
+    const safeUsed = Number.isFinite(used) ? Number(used) : 0;
+    return Math.max(safeLimit - safeUsed, 0);
+}
+function formatRemainingLimit(limit, used, singular, plural = `${singular}s`) {
+    if (!Number.isFinite(limit)) {
+        return `Unlimited ${plural}`;
+    }
+    const safeLimit = Number(limit);
+    const safeUsed = Number.isFinite(used) ? Number(used) : 0;
+    const remaining = Math.max(safeLimit - safeUsed, 0);
+    return `${remaining} left (${safeUsed}/${safeLimit} used)`;
+}
+function formatWorkspaceAccessLine(workspace) {
+    const workspaceId = String(workspace.id || workspace.gaid || workspace.passportGaid || 'unknown');
+    return `- ${summarizeWorkspaceLabel(workspace)} | id=${workspaceId}`;
+}
+function isWorkspaceProjectsResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function isWorkspaceCreateResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function isWorkspaceProjectCreateResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function formatWorkspaceProjectLine(project) {
+    const projectId = String(project.id || 'unknown');
+    return `- ${summarizeProjectLabel(project)} | id=${projectId}`;
+}
+function resolveOperatingMode(service) {
+    const entitlements = service.getServiceEntitlements();
+    const normalizedTier = String(entitlements.tier || '').trim().toLowerCase();
+    if (['origin', 'free', 'solo'].includes(normalizedTier)) {
+        return {
+            mode: 'solo',
+            tier: normalizedTier || null,
+        };
+    }
+    if (normalizedTier) {
+        return {
+            mode: 'governed',
+            tier: normalizedTier,
+        };
+    }
+    const permissions = service.getConnectPermissions();
+    const draftRule = permissions.rules.find((rule) => rule.action === 'connect_model_draft');
+    const reason = String(draftRule?.reason || '').toLowerCase();
+    const scopeRequired = reason.includes('workspace/project') || reason.includes('scope');
+    return {
+        mode: scopeRequired ? 'governed' : 'solo',
+        tier: null,
+    };
+}
+function getSessionDisplayName(sessionRef) {
+    const payload = parseJwtPayload(sessionRef);
+    const candidates = [
+        payload?.name,
+        payload?.display_name,
+        payload?.given_name,
+        payload?.preferred_username,
+        payload?.email,
+    ];
+    for (const candidate of candidates) {
+        if (typeof candidate === 'string' && candidate.trim()) {
+            return candidate.trim();
+        }
+    }
+    return null;
+}
+function isPassportDraftListResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function isPassportDraftResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function isPassportDraftPublishResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function isPassportResponse(body) {
+    return !!body && typeof body === 'object';
+}
+function readDraftMetadata(draft) {
+    const payload = draft.payload && typeof draft.payload === 'object' ? draft.payload : null;
+    const metadata = payload?.metadata;
+    return metadata && typeof metadata === 'object' && !Array.isArray(metadata)
+        ? metadata
+        : {};
+}
+function formatDraftLine(draft) {
+    const metadata = readDraftMetadata(draft);
+    const workspaceId = String(metadata.workspaceId || metadata.workspace_id || 'n/a');
+    const projectId = String(metadata.projectId || metadata.project_id || 'n/a');
+    const payload = draft.payload && typeof draft.payload === 'object' ? draft.payload : null;
+    const connectionStatus = String(payload?.connectionStatus || metadata.connection_status || 'n/a');
+    const draftId = String(draft.id || 'unknown');
+    const name = String(draft.name || 'Unnamed draft');
+    const passportType = String(draft.passportType || 'unknown');
+    return `- ${draftId} | ${name} | type=${passportType} | workspace=${workspaceId} | project=${projectId} | connection=${connectionStatus}`;
+}
+function deriveModelSizeLabel(sizeBytes) {
+    const size = Number(sizeBytes);
+    if (!Number.isFinite(size) || size <= 0) {
+        return 'size unknown';
+    }
+    const gib = size / (1024 ** 3);
+    if (gib >= 1) {
+        return `${gib.toFixed(gib >= 10 ? 0 : 1)} GB download`;
+    }
+    const mib = size / (1024 ** 2);
+    return `${mib.toFixed(mib >= 100 ? 0 : 1)} MB download`;
+}
+function readModelFamily(model) {
+    const metadata = model.metadata && typeof model.metadata === 'object' ? model.metadata : null;
+    const family = String(metadata?.family || metadata?.architectureFamily || model.architectureFamily || '').trim();
+    return family || null;
+}
+function readModelParameterLabel(model) {
+    const metadata = model.metadata && typeof model.metadata === 'object' ? model.metadata : null;
+    const parameterSize = String(model.parameterSize || metadata?.parameterSize || metadata?.parameter_count || '').trim();
+    if (!parameterSize)
+        return null;
+    return /b$/i.test(parameterSize) ? `${parameterSize.toUpperCase()} parameters` : parameterSize;
+}
+function formatModelFriendlySummary(model) {
+    const family = readModelFamily(model);
+    const parameters = readModelParameterLabel(model);
+    const runtime = String(model.runtimeName || model.runtime || 'local runtime').trim();
+    const highlights = [family, parameters, deriveModelSizeLabel(model.sizeBytes)].filter(Boolean);
+    return `${model.model} runs on ${runtime}${highlights.length ? ` · ${highlights.join(' · ')}` : ''}`;
+}
+function formatModelFriendlyExplanation(model) {
+    const family = readModelFamily(model);
+    const source = String(model.sourceLabel || 'Detected locally').trim();
+    if (family) {
+        return `${model.model} looks like a ${family} model detected on this device. ${source}.`;
+    }
+    return `${model.model} is a local model detected on this device. ${source}.`;
+}
+function readPassportList(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+        return [];
+    }
+    const passports = body.passports;
+    if (!Array.isArray(passports)) {
+        return [];
+    }
+    return passports.filter((item) => !!item && typeof item === 'object' && !Array.isArray(item));
+}
+function formatPassportLine(passport) {
+    const gaid = String(passport.gaid || passport.id || 'unknown');
+    const name = String(passport.name || 'Unnamed passport');
+    const passportType = String(passport.passportType || 'unknown');
+    const workspaceId = String(passport.workspaceId || 'n/a');
+    const projectId = String(passport.projectId || 'n/a');
+    const connectionStatus = String(passport.connectionStatus || 'n/a');
+    return `- ${gaid} | ${name} | type=${passportType} | workspace=${workspaceId} | project=${projectId} | connection=${connectionStatus}`;
+}
+function formatWorkspaceVisibility(value) {
+    const visibility = String(value || '').trim().toLowerCase();
+    if (visibility === 'private' || visibility === 'public') {
+        return visibility;
+    }
+    return 'visibility not set';
+}
+function summarizeWorkspaceLabel(workspace) {
+    const name = String(workspace.name || 'Unnamed workspace').trim();
+    const role = String(workspace.role || 'unknown').trim();
+    const visibility = formatWorkspaceVisibility(workspace.visibility);
+    const description = String(workspace.description || '').trim();
+    const detail = [visibility, role].filter(Boolean).join(' · ');
+    return `${name}${detail ? ` · ${detail}` : ''}${description ? ` — ${description}` : ''}`;
+}
+function summarizeProjectLabel(project) {
+    const name = String(project.name || 'Unnamed project').trim();
+    const status = String(project.status || '').trim();
+    const passportCount = Number(project.passportCount);
+    const description = String(project.description || '').trim();
+    const detailParts = [
+        status || null,
+        Number.isFinite(passportCount) && passportCount >= 0 ? `${passportCount} passport${passportCount === 1 ? '' : 's'}` : null,
+    ].filter((value) => Boolean(value));
+    return `${name}${detailParts.length ? ` · ${detailParts.join(' · ')}` : ''}${description ? ` — ${description}` : ''}`;
+}
+function buildPassportWebsiteUrl(gaid) {
+    return `${DEFAULT_BASE_URL}/passport/${encodeURIComponent(gaid)}`;
+}
+function buildDraftWebsiteUrl(draftId) {
+    return `${DEFAULT_BASE_URL}/register-passport?draftId=${encodeURIComponent(draftId)}`;
+}
+function summarizeScopeChoice(workspacePrepared) {
+    if (workspacePrepared) {
+        return 'Workspace mode lets you pick another workspace/project or keep using the current one.';
+    }
+    return 'Workspace mode lets you choose an existing workspace/project or create new ones now.';
+}
+function formatScopeReferenceLabel(value, kind) {
+    const normalized = String(value || '').trim();
+    if (!normalized) {
+        return kind === 'workspace' ? 'not selected' : 'not selected';
+    }
+    return `selected on this device (${shortId(normalized)})`;
+}
+function printUpdateCheckLines(lines, useErrorStream = false) {
+    for (const line of lines) {
+        if (useErrorStream) {
+            console.error(line);
+            continue;
+        }
+        console.log(line);
+    }
+}
+function formatFindingLine(finding) {
+    const label = finding.classification === 'shadow_candidate'
+        ? 'Unconnected AI runtime'
+        : finding.classification === 'provider_unavailable'
+            ? 'Runtime unavailable'
+            : finding.classification === 'registered_runtime'
+                ? 'Connected local runtime'
+                : 'Unconnected AI model';
+    const nextStep = finding.classification === 'provider_unavailable'
+        ? 'Check whether this runtime should be installed and running.'
+        : finding.classification === 'shadow_candidate'
+            ? 'Review this runtime before connecting it.'
+            : 'Review or connect this local model.';
+    if (finding.kind === 'process') {
+        const process = finding.process;
+        const confidence = process?.confidence ? ` | confidence=${process.confidence}` : '';
+        const source = process?.source_label ? ` | source=${process.source_label}` : '';
+        const matchedTerms = process?.matched_terms?.length ? ` | matched=${process.matched_terms.join(',')}` : '';
+        return `- ${label} | process=${finding.process_name || 'unknown'} | runtime=${finding.runtime || 'unknown'}${confidence}${source}${matchedTerms} | next=${nextStep}`;
+    }
+    if (finding.kind === 'provider') {
+        return `- ${label} | runtime=${finding.runtime || 'unknown'} | next=${nextStep}`;
+    }
+    return `- ${label} | model=${finding.model || 'unknown'} | runtime=${finding.runtime || 'unknown'} | next=${nextStep}`;
+}
+function formatReviewStatusLabel(status) {
+    switch (status) {
+        case 'new_unregistered':
+        case 'known_unregistered':
+            return 'Unconnected AI models';
+        case 'pending_draft':
+            return 'Pending Passport drafts';
+        case 'bound_passport':
+            return 'Connected models';
+        case 'shadow_candidate':
+            return 'Unconnected AI runtimes';
+        case 'provider_unavailable':
+            return 'Unavailable runtimes';
+    }
+}
+function formatReviewActionLabel(action) {
+    switch (action) {
+        case 'connect_model':
+            return 'Run `forkit-connect connect <model>` when you are ready.';
+        case 'review_drafts':
+            return 'Review the local Passport draft.';
+        case 'already_connected':
+            return 'Already connected.';
+        case 'review/runtime':
+            return 'Check whether this runtime should be installed and running.';
+        case 'review/connect':
+        case 'review_model':
+            return 'Review or connect this local AI item.';
+        default:
+            return action;
+    }
+}
+function printDiscoverySummary(summary) {
+    console.log(`[forkit-connect] Discovery mode=${summary.discovery_mode} providers=${summary.providers_detected} models=${summary.models_detected} new_unregistered=${summary.new_unregistered_count} known_unregistered=${summary.known_unregistered_count} registered_runtime=${summary.registered_runtime_count} shadow_candidate=${summary.shadow_candidate_count} provider_unavailable=${summary.provider_unavailable_count}`);
+    for (const finding of summary.findings) {
+        console.log(formatFindingLine(finding));
+    }
+}
+function printConfig(config) {
+    console.log(JSON.stringify(config, null, 2));
+}
+function printConnectInit(result) {
+    console.log(JSON.stringify({
+        identity: result.identity,
+        entitlements: result.entitlements,
+        permissions: result.permissions,
+        privacy_summary: result.privacy_summary,
+    }, null, 2));
+}
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+const INTERACTIVE_LABEL_WIDTH = 24;
+function canRenderInteractiveShell() {
+    return Boolean(node_process_1.stdin.isTTY && node_process_1.stdout.isTTY);
+}
+function clearInteractiveScreen() {
+    if (!canRenderInteractiveShell())
+        return;
+    node_process_1.stdout.write('\u001B[2J\u001B[H');
+}
+function renderInteractiveScreen(title, options) {
+    if (!canRenderInteractiveShell()) {
+        console.log(`[forkit-connect] ${title}`);
+        if (options?.subtitle) {
+            console.log(options.subtitle);
+        }
+        for (const section of options?.sections || []) {
+            console.log(`${section.title}:`);
+            for (const line of section.lines) {
+                console.log(line);
+            }
+        }
+        for (const line of options?.footerLines || []) {
+            console.log(line);
+        }
+        return;
+    }
+    clearInteractiveScreen();
+    const bold = '\u001B[1m';
+    const dim = '\u001B[2m';
+    const reset = '\u001B[0m';
+    const divider = `${dim}${'─'.repeat(72)}${reset}`;
+    const lines = [
+        `${bold}${title}${reset}`,
+        options?.subtitle ? `${dim}${options.subtitle}${reset}` : null,
+        divider,
+        ...((options?.sections || []).flatMap((section) => [
+            `${bold}${section.title}${reset}`,
+            ...(section.lines.length > 0 ? section.lines : [`${dim}No items yet.${reset}`]),
+            '',
+        ])),
+        ...(options?.footerLines?.length ? [divider, ...options.footerLines] : []),
+    ].filter((value) => typeof value === 'string');
+    node_process_1.stdout.write(`${lines.join('\n')}\n`);
+}
+function shellLine(label, value) {
+    const normalized = value === null || value === undefined || `${value}`.trim() === '' ? 'n/a' : String(value);
+    return `• ${`${label}:`.padEnd(INTERACTIVE_LABEL_WIDTH, ' ')}${normalized}`;
+}
+function shellListLine(value) {
+    return `• ${value}`;
+}
+function buildInteractiveOverviewSections(service, sessionState, accountLimits) {
+    const overview = service.getConnectStatusOverview();
+    const inbox = service.buildSmartRegistrationInbox();
+    const leftoverReady = inbox.groups.ready_to_connect.slice(0, 4).map((item) => shellListLine(item.display_name));
+    const leftoverNeedsConfirmation = inbox.groups.needs_confirmation.slice(0, 4).map((item) => shellListLine(item.display_name));
+    const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+    const preparedWorkspace = accountTrusted ? String(overview.workspace_id || '').trim() : '';
+    const preparedProject = accountTrusted ? String(overview.project_id || '').trim() : '';
+    // Base section: always visible
+    const sections = [
+        {
+            title: 'Overview',
+            lines: [
+                shellLine('Session', sessionState),
+                shellLine('Device paired', overview.device_paired),
+                shellLine('Daemon', overview.daemon_status),
+                shellLine('Privacy mode', overview.privacy_mode),
+            ],
+        },
+    ];
+    // Account-bound sections: only shown after login
+    if (accountTrusted) {
+        sections.push({
+            title: 'Discovery',
+            lines: [
+                shellLine('Models', overview.models_discovered),
+                shellLine('Agents', overview.agents_discovered),
+                shellLine('Runtimes', overview.runtimes_discovered),
+                shellLine('C2 sync pending', overview.c2_sync_pending),
+            ],
+        });
+        sections.push({
+            title: 'Inbox',
+            lines: [
+                shellLine('Ready to connect', overview.ready_to_connect_count),
+                shellLine('Needs confirmation', overview.needs_confirmation_count),
+                shellLine('Connected', overview.connected_count),
+                ...(overview.lifecycle_note ? [shellLine('Note', overview.lifecycle_note)] : []),
+            ],
+        });
+        if (accountLimits) {
+            sections.push({
+                title: 'Plan & Limits',
+                lines: [
+                    shellLine('Plan', accountLimits.planName),
+                    shellLine('Private passports', formatRemainingLimit(accountLimits.privatePassportsLimit, accountLimits.privatePassportsUsed, 'private passport')),
+                    shellLine('Drafts', formatRemainingLimit(accountLimits.draftLimit, accountLimits.draftsUsed, 'draft')),
+                    shellLine('Workspaces', formatRemainingLimit(accountLimits.workspaceLimit, accountLimits.workspacesUsed, 'workspace')),
+                    shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
+                    ...(accountLimits.runtimeSignalsLimit !== null || accountLimits.runtimeSignalsUsed !== null
+                        ? [shellLine('Runtime signals', formatRemainingLimit(accountLimits.runtimeSignalsLimit, accountLimits.runtimeSignalsUsed, 'runtime signal'))]
+                        : []),
+                ],
+            });
+        }
+        sections.push({
+            title: 'Active Scope',
+            lines: [
+                shellLine('Workspace', formatScopeReferenceLabel(preparedWorkspace || null, 'workspace')),
+                shellLine('Project', formatScopeReferenceLabel(preparedProject || null, 'project')),
+                shellLine('Ready to connect', inbox.groups.ready_to_connect.length),
+                shellLine('Needs confirmation', inbox.groups.needs_confirmation.length),
+                ...leftoverReady,
+                ...leftoverNeedsConfirmation,
+            ],
+        });
+    }
+    return sections;
+}
+function buildInteractiveChangesSections(service, limit) {
+    const state = service.getStateStore().readState();
+    const recentEvidence = [...state.evidence_events].slice(-limit).reverse();
+    const recentPulse = service.getPulseHistory(limit);
+    const evidenceTypeCounts = [...state.evidence_events.reduce((map, event) => {
+            map.set(event.type, (map.get(event.type) || 0) + 1);
+            return map;
+        }, new Map()).entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]));
+    return [
+        {
+            title: 'Collected State',
+            lines: [
+                shellLine('Evidence events', state.evidence_events.length),
+                shellLine('Pulse events', state.pulse_events.length),
+                shellLine('Sync queue', state.sync_queue.length),
+                shellLine('Pending reviews', state.pending_reviews.length),
+                shellLine('Evolution candidates', state.evolution_candidates.length),
+            ],
+        },
+        {
+            title: 'Evidence Types',
+            lines: evidenceTypeCounts.slice(0, 8).map(([type, count]) => shellLine(type, count)),
+        },
+        {
+            title: 'Recent Evidence',
+            lines: recentEvidence.slice(0, 8).map((event) => shellListLine(`${formatTimestamp(event.createdAt)} | ${event.type}${formatEvidenceDetails(event.details)}`)),
+        },
+        {
+            title: 'Recent Runtime Signals',
+            lines: recentPulse.slice(0, 6).map((event) => shellListLine(`${event.runtime_name} | ${event.model_name || 'n/a'} | ${event.pulse_status} | ${event.measured_at}`)),
+        },
+    ];
+}
+function buildInteractiveInboxSections(inbox) {
+    const summarize = (items, limit = 4) => (items.slice(0, limit).map((item) => shellListLine(`${item.display_name} | ${item.item_type} | ${formatSmartInboxActionLabel(item)}`)));
+    return [
+        {
+            title: 'Summary',
+            lines: [
+                shellLine('Ready to connect', inbox.groups.ready_to_connect.length),
+                shellLine('Needs confirmation', inbox.groups.needs_confirmation.length),
+                shellLine('Connected', inbox.groups.connected.length),
+                shellLine('Ignored', inbox.groups.ignored.length),
+                ...(inbox.summary.next_recommended_action ? [shellLine('Next action', formatSmartInboxActionValue(inbox.summary.next_recommended_action))] : []),
+            ],
+        },
+        {
+            title: 'Needs Confirmation',
+            lines: summarize(inbox.groups.needs_confirmation),
+        },
+        {
+            title: 'Ready to Connect',
+            lines: summarize(inbox.groups.ready_to_connect),
+        },
+    ];
+}
+function buildInteractiveInboxItemSections(item, group) {
+    const formattedGroup = group === 'ready_to_connect'
+        ? 'Ready'
+        : group === 'needs_confirmation'
+            ? 'Needs confirmation'
+            : group === 'connected'
+                ? 'Connected'
+                : group === 'ignored'
+                    ? 'Ignored'
+                    : group.replaceAll('_', ' ');
+    const detailKeys = [
+        'verification_summary',
+        'limitations_summary',
+        'scope_suggestion',
+        'scope_mismatch_reason',
+        'connectable_model_name',
+        'linked_model_candidate',
+        'public_state',
+        'last_seen',
+    ];
+    return [
+        {
+            title: 'Item',
+            lines: [
+                shellLine('Name', item.display_name),
+                shellLine('Group', formattedGroup),
+                shellLine('Type', item.item_type),
+                shellLine('Source', item.detected_source),
+                shellLine('Confidence', item.confidence),
+                shellLine('Next', formattedGroup === 'Connected' ? 'View activity logs' : formatSmartInboxActionLabel(item)),
+                ...(item.workspaceId ? [shellLine('Workspace', formatScopeReferenceLabel(item.workspaceId, 'workspace'))] : []),
+                ...(item.projectId ? [shellLine('Project', formatScopeReferenceLabel(item.projectId, 'project'))] : []),
+                ...(item.passport_gaid ? [shellLine('Passport GAID', item.passport_gaid)] : []),
+                ...(item.matched_passport_gaid && item.matched_passport_gaid !== item.passport_gaid ? [shellLine('Matched passport', item.matched_passport_gaid)] : []),
+            ],
+        },
+        {
+            title: 'Details',
+            lines: detailKeys
+                .map((key) => {
+                const value = String(item.details_received_automatically[key] || '').trim();
+                return value ? shellLine(key, value) : null;
+            })
+                .filter((value) => typeof value === 'string'),
+        },
+    ];
+}
+function normalizeComparable(value) {
+    return String(value || '').trim().toLowerCase();
+}
+function getInboxItemModelName(item) {
+    if (item.item_type === 'model') {
+        return String(item.display_name || '').trim() || null;
+    }
+    const connectable = String(item.details_received_automatically.connectable_model_name || '').trim();
+    return connectable || null;
+}
+function matchesEvidenceToConnectedItem(event, options) {
+    const details = event.details || {};
+    const values = [
+        details.modelName,
+        details.model_name,
+        details.model,
+        details.discoveryHash,
+        details.discovery_hash,
+        details.registrationKey,
+        details.registration_key,
+        details.passportGaid,
+        details.passport_gaid,
+        details.gaid,
+    ].map(normalizeComparable);
+    return Boolean((options.modelName && values.includes(normalizeComparable(options.modelName)))
+        || (options.discoveryHash && values.includes(normalizeComparable(options.discoveryHash)))
+        || (options.registrationKey && values.includes(normalizeComparable(options.registrationKey)))
+        || (options.passportGaid && values.includes(normalizeComparable(options.passportGaid))));
+}
+function matchesPulseToConnectedItem(event, options) {
+    return Boolean((options.modelName && normalizeComparable(event.model_name) === normalizeComparable(options.modelName))
+        || (options.discoveryHash && normalizeComparable(event.discovery_hash) === normalizeComparable(options.discoveryHash))
+        || (options.registrationKey && normalizeComparable(event.registration_key) === normalizeComparable(options.registrationKey))
+        || (options.passportGaid && normalizeComparable(event.bound_passport_gaid) === normalizeComparable(options.passportGaid)));
+}
+function buildConnectedItemActivitySections(service, item) {
+    const state = service.getStateStore().readState();
+    const selector = item.item_id.split(':').slice(1).join(':');
+    const detectedModel = item.item_type === 'model'
+        ? state.detected_models.find((entry) => entry.discoveryHash === selector)
+            ?? resolveSingleDetectedModelByName(service, item.display_name)
+        : null;
+    const discoveryHash = detectedModel?.discoveryHash || selector || null;
+    const binding = state.model_bindings.find((entry) => ((item.passport_gaid && entry.gaid === item.passport_gaid)
+        || (discoveryHash && entry.discoveryHash === discoveryHash))) ?? null;
+    const modelName = getInboxItemModelName(item);
+    const recentEvidence = state.evidence_events
+        .filter((event) => matchesEvidenceToConnectedItem(event, {
+        modelName,
+        discoveryHash,
+        registrationKey: binding?.registrationKey ?? null,
+        passportGaid: binding?.gaid ?? item.passport_gaid ?? null,
+    }))
+        .slice(-6)
+        .reverse();
+    const recentPulse = service.getPulseHistory(50)
+        .filter((event) => matchesPulseToConnectedItem(event, {
+        modelName,
+        discoveryHash,
+        registrationKey: binding?.registrationKey ?? null,
+        passportGaid: binding?.gaid ?? item.passport_gaid ?? null,
+    }))
+        .slice(-6)
+        .reverse();
+    return [
+        {
+            title: 'Connection',
+            lines: [
+                shellLine('Model', modelName || item.display_name),
+                shellLine('Connected', binding?.status === 'bound' || Boolean(item.passport_gaid) ? 'yes' : 'no'),
+                shellLine('Passport', binding?.gaid || item.passport_gaid || 'not linked yet'),
+                shellLine('Workspace', binding?.workspaceName || formatScopeReferenceLabel(binding?.workspaceId ?? null, 'workspace')),
+                shellLine('Project', binding?.projectName || formatScopeReferenceLabel(binding?.projectId ?? null, 'project')),
+                shellLine('Last updated', binding?.updatedAt || 'n/a'),
+            ],
+        },
+        {
+            title: 'Recent Activity',
+            lines: recentEvidence.length > 0
+                ? recentEvidence.map((event) => shellListLine(`${formatTimestamp(event.createdAt)} · ${event.type}`))
+                : [shellListLine('No local activity logs recorded for this connected item yet.')],
+        },
+        {
+            title: 'Runtime Signals',
+            lines: recentPulse.length > 0
+                ? recentPulse.map((event) => shellListLine(`${event.measured_at} · ${event.runtime_name} · ${event.pulse_status}`))
+                : [shellListLine('No runtime signal history recorded for this connected item yet.')],
+        },
+    ];
+}
+function formatPulseMetric(value, suffix) {
+    return value === null || value === undefined ? 'n/a' : `${value}${suffix}`;
+}
+function pulseMetricNote(metric, fallback) {
+    return typeof metric?.note === 'string' && metric.note.trim()
+        ? metric.note
+        : fallback;
+}
+function formatPulseMetricWithNote(value, suffix, unavailableNote) {
+    return value === null || value === undefined ? unavailableNote : `${value}${suffix}`;
+}
+function printPulseSummary(summary) {
+    console.log(`[forkit-connect] Runtime signals pulse measured_at=${summary.measured_at} overall=${summary.pulse_status} observation_mode=${summary.observation_mode || 'metadata_only'} degraded_mode=${summary.degraded_mode || 'normal'} green=${summary.green_count} amber=${summary.amber_count} red=${summary.red_count} unknown=${summary.unknown_count}`);
+    console.log('[forkit-connect] Runtime signals fields are best-effort local measurements and are not billing records.');
+    if (summary.degraded_reasons?.length) {
+        console.log(`[forkit-connect] Degraded observation: ${summary.degraded_reasons.join(' | ')}`);
+    }
+    for (const entry of summary.entries) {
+        console.log(`- runtime=${entry.runtime_name} | model=${entry.model_name || 'n/a'} | registration=${entry.registration_state} | observation_mode=${entry.observation_mode || 'metadata_only'} | degraded_mode=${entry.degraded_mode || 'normal'} | port_alive=${String(entry.port_alive)} | process_alive=${String(entry.process_alive)} | provider_status=${entry.provider_status} | pulse_status=${entry.pulse_status}`);
+        console.log(`  metrics: cpu=${formatPulseMetricWithNote(entry.cpu_usage_percent, '%', pulseMetricNote(entry.metric_availability?.cpu_usage_percent, 'CPU metrics were unavailable this cycle.'))} | memory=${formatPulseMetricWithNote(entry.memory_usage_mb, 'MB', pulseMetricNote(entry.metric_availability?.memory_usage_mb, 'Memory metrics were unavailable this cycle.'))} | uptime=${formatPulseMetricWithNote(entry.uptime_seconds, 's', pulseMetricNote(entry.metric_availability?.uptime_seconds, 'Runtime uptime was unavailable this cycle.'))} | latency=${formatPulseMetricWithNote(entry.runtime_latency_ms, 'ms', pulseMetricNote(entry.metric_availability?.runtime_latency_ms, 'Latency was unavailable this cycle.'))} | token_metrics=${pulseMetricNote(entry.metric_availability?.token_metrics, 'Token metrics stay unavailable in metadata-only observation mode.')} | gpu_available=${String(entry.gpu_available)} | gpu_vram=${formatPulseMetric(entry.gpu_vram_used_mb, 'MB')} | gpu_util=${formatPulseMetric(entry.gpu_utilization_percent, '%')}`);
+        if (entry.degraded_reasons?.length) {
+            console.log(`  degraded_reasons=${entry.degraded_reasons.join(' | ')}`);
+        }
+    }
+}
+function formatPulseRegistrationLabel(event) {
+    if (event.binding_status === 'bound')
+        return 'bound';
+    if (event.binding_status === 'pending')
+        return 'registered';
+    return event.registration_state;
+}
+function printPulseHistory(events, limit) {
+    console.log(`[forkit-connect] Runtime signals history showing=${events.length} limit=${limit}`);
+    console.log('[forkit-connect] History entries show best-effort runtime signals only, not billing records.');
+    for (const event of events) {
+        console.log(`- measured_at=${event.measured_at} | runtime=${event.runtime_name} | model=${event.model_name || 'n/a'} | registration=${formatPulseRegistrationLabel(event)} | observation_mode=${event.observation_mode || 'metadata_only'} | degraded_mode=${event.degraded_mode || 'normal'} | pulse_status=${event.pulse_status} | port_alive=${String(event.port_alive)} | process_alive=${String(event.process_alive)} | gpu_available=${String(event.gpu_available)} | gpu_vram=${formatPulseMetric(event.gpu_vram_used_mb, 'MB')} | gpu_util=${formatPulseMetric(event.gpu_utilization_percent, '%')}`);
+        console.log(`  metrics: cpu=${formatPulseMetricWithNote(event.cpu_usage_percent, '%', pulseMetricNote(event.metric_availability?.cpu_usage_percent, 'CPU metrics were unavailable this cycle.'))} | memory=${formatPulseMetricWithNote(event.memory_usage_mb, 'MB', pulseMetricNote(event.metric_availability?.memory_usage_mb, 'Memory metrics were unavailable this cycle.'))} | uptime=${formatPulseMetricWithNote(event.uptime_seconds, 's', pulseMetricNote(event.metric_availability?.uptime_seconds, 'Runtime uptime was unavailable this cycle.'))} | latency=${formatPulseMetricWithNote(event.runtime_latency_ms, 'ms', pulseMetricNote(event.metric_availability?.runtime_latency_ms, 'Latency was unavailable this cycle.'))} | token_metrics=${pulseMetricNote(event.metric_availability?.token_metrics, 'Token metrics stay unavailable in metadata-only observation mode.')}`);
+        if (event.degraded_reasons?.length) {
+            console.log(`  degraded_reasons=${event.degraded_reasons.join(' | ')}`);
+        }
+    }
+}
+function formatTimestamp(value) {
+    return typeof value === 'string' && value.trim() ? value : 'n/a';
+}
+function formatEvidenceDetails(details) {
+    const entries = Object.entries(details)
+        .filter(([, value]) => value !== null && value !== undefined && `${value}`.trim() !== '')
+        .slice(0, 4)
+        .map(([key, value]) => `${key}=${typeof value === 'string' ? value : JSON.stringify(value)}`);
+    return entries.length > 0 ? ` | ${entries.join(' | ')}` : '';
+}
+function printCollectedChanges(service, limit) {
+    const state = service.getStateStore().readState();
+    const paths = service.getStateStore().getPaths();
+    const recentEvidence = [...state.evidence_events].slice(-limit).reverse();
+    const recentPulse = service.getPulseHistory(limit);
+    const evidenceTypeCounts = new Map();
+    for (const event of state.evidence_events) {
+        evidenceTypeCounts.set(event.type, (evidenceTypeCounts.get(event.type) || 0) + 1);
+    }
+    console.log('[forkit-connect] Collected changes');
+    console.log(`- state_dir=${paths.stateDir}`);
+    console.log(`- state_file=${paths.stateFile}`);
+    console.log(`- evidence_events=${state.evidence_events.length}`);
+    console.log(`- pulse_events=${state.pulse_events.length}`);
+    console.log(`- sync_queue=${state.sync_queue.length}`);
+    console.log(`- pending_reviews=${state.pending_reviews.length}`);
+    console.log(`- evolution_candidates=${state.evolution_candidates.length}`);
+    console.log(`- c2_events=${state.c2_events.length}`);
+    console.log(`- detected_models=${state.detected_models.length}`);
+    console.log(`- detected_runtimes=${state.detected_runtimes.length}`);
+    console.log(`- detected_agents=${state.detected_agents.length}`);
+    console.log('[forkit-connect] Some collected changes are local advisory telemetry and review evidence; only synced queue items become backend-authoritative.');
+    const sortedEvidenceTypes = [...evidenceTypeCounts.entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]));
+    if (sortedEvidenceTypes.length > 0) {
+        console.log('[forkit-connect] Evidence types observed:');
+        for (const [type, count] of sortedEvidenceTypes) {
+            console.log(`- ${type}: ${count}`);
+        }
+    }
+    if (recentEvidence.length > 0) {
+        console.log(`[forkit-connect] Recent evidence events showing=${recentEvidence.length} limit=${limit}`);
+        for (const event of recentEvidence) {
+            console.log(`- ${formatTimestamp(event.createdAt)} | ${event.type}${formatEvidenceDetails(event.details)}`);
+        }
+    }
+    if (recentPulse.length > 0) {
+        console.log(`[forkit-connect] Recent runtime signal history showing=${recentPulse.length} limit=${limit}`);
+        for (const event of recentPulse) {
+            console.log(`- ${event.measured_at} | runtime=${event.runtime_name} | model=${event.model_name || 'n/a'} | pulse=${event.pulse_status} | registration=${formatPulseRegistrationLabel(event)}`);
+        }
+    }
+    if (state.sync_queue.length > 0) {
+        console.log('[forkit-connect] Pending sync queue:');
+        for (const item of state.sync_queue.slice(0, limit)) {
+            console.log(`- ${item.type} | endpoint=${item.endpoint} | attempts=${item.attempts} | created_at=${item.createdAt} | next_retry_at=${item.nextRetryAt} | last_error=${item.lastError || 'n/a'}`);
+        }
+    }
+}
+function shortId(value, length = 10) {
+    if (!value)
+        return 'n/a';
+    return value.slice(0, length);
+}
+function formatReviewEvidence(entry) {
+    const hints = [];
+    if (entry.confidence) {
+        hints.push(`confidence=${entry.confidence}`);
+    }
+    if (entry.source_label) {
+        hints.push(`source=${entry.source_label}`);
+    }
+    if (entry.matched_terms?.length) {
+        hints.push(`matched=${entry.matched_terms.join(',')}`);
+    }
+    if (entry.reason) {
+        hints.push(`reason=${entry.reason}`);
+    }
+    return hints.length > 0 ? ` | ${hints.join(' | ')}` : '';
+}
+function printReviewSnapshot(snapshot) {
+    const order = [
+        'new_unregistered',
+        'known_unregistered',
+        'pending_draft',
+        'bound_passport',
+        'shadow_candidate',
+        'provider_unavailable',
+    ];
+    console.log(`[forkit-connect] Review items=${snapshot.total}`);
+    for (const status of order) {
+        const entries = snapshot.groups[status];
+        if (entries.length === 0)
+            continue;
+        console.log(`${formatReviewStatusLabel(status)}: ${entries.length}`);
+        for (const entry of entries) {
+            console.log(`- item=${entry.model_name || entry.process_name || 'n/a'} | runtime=${entry.runtime_name || 'n/a'} | discovery=${shortId(entry.discovery_hash)} | registration=${shortId(entry.registration_key)} | next=${formatReviewActionLabel(entry.suggested_action)}${formatReviewEvidence(entry)}`);
+        }
+    }
+}
+function printC2Status(status) {
+    console.log(JSON.stringify({
+        authenticated: status.authenticated,
+        bound: status.bound,
+        runtimeSignal_key_configured: status.runtimeSignalKeyConfigured,
+        bound_gaid: status.boundGaid,
+        pending_events: status.pendingEvents,
+        local_only_events: status.localOnlyEvents,
+        synced_events: status.syncedEvents,
+        last_sync_at: status.lastSyncAt,
+        last_sync_error: status.lastSyncError,
+    }, null, 2));
+}
+function printTrainStatus(status) {
+    if (Array.isArray(status)) {
+        console.log(JSON.stringify({
+            total_build_sessions: status.length,
+            sessions: status,
+        }, null, 2));
+        return;
+    }
+    console.log(JSON.stringify(status, null, 2));
+}
+function printAgentReview(snapshot) {
+    const order = ['new_agent', 'known_agent', 'linked_agent', 'inactive_agent', 'unknown_ai_tool'];
+    console.log(`[forkit-connect] Agent review items=${snapshot.total}`);
+    for (const status of order) {
+        const entries = snapshot.groups[status];
+        if (entries.length === 0)
+            continue;
+        console.log(`${status}: ${entries.length}`);
+        for (const entry of entries) {
+            console.log(`- agent=${entry.agent_name} | type=${entry.agent_type} | status=${entry.status} | id=${shortId(entry.agent_id)} | linked_model=${entry.linked_model_name || 'n/a'} | passport=${entry.linked_passport_gaid || 'n/a'} | action=${entry.suggested_action}${formatReviewEvidence(entry)}`);
+        }
+    }
+}
+function printAgentStatus(status) {
+    console.log(JSON.stringify({
+        detected_agents: status.detectedAgents,
+        connected_agents: status.connectedAgents,
+        linked_agents: status.linkedAgents,
+        unlinked_agents: status.unlinkedAgents,
+        latest_agent_lifecycle_event: status.latestAgentLifecycleEvent,
+        c2_sync_status: status.c2SyncStatus,
+    }, null, 2));
+}
+function printAgentLedger(summary) {
+    console.log(JSON.stringify(summary, null, 2));
+}
+function printRuntimeReview(summary) {
+    console.log(`[forkit-connect] Runtime review items=${summary.total_runtimes}`);
+    for (const runtime of summary.runtimes) {
+        console.log(`- runtime=${runtime.runtime_name} | type=${runtime.runtime_type} | status=${runtime.status} | gaid=${shortId(runtime.runtime_gaid)} | linked_models=${runtime.linked_models_count} | linked_agents=${runtime.linked_agents_count} | health=${runtime.health_status} | next=${runtime.recommended_action}`);
+    }
+}
+function printRuntimeStatus(status) {
+    console.log(JSON.stringify({
+        total_runtimes: status.total_runtimes,
+        online_runtimes: status.online_runtimes,
+        offline_runtimes: status.offline_runtimes,
+        linked_runtimes: status.linked_runtimes,
+        unlinked_runtimes: status.unlinked_runtimes,
+        unhealthy_runtimes: status.unhealthy_runtimes,
+        latest_runtime_lifecycle_event: status.latest_runtime_lifecycle_event,
+        c2_pending_count: status.c2_pending_count,
+    }, null, 2));
+}
+function formatSmartInboxActionValue(action, itemType, connectableModelName) {
+    switch (action) {
+        case 'connect_existing_passport':
+            return 'Open Registered Passport';
+        case 'create_passport_draft':
+            if (itemType === 'agent')
+                return 'Register Agent';
+            if (itemType === 'runtime')
+                return connectableModelName ? `Register ${connectableModelName}` : 'Register Runtime';
+            return 'Register Model';
+        case 'link_agent_to_model':
+            return 'Register Agent';
+        case 'confirm_version_candidate':
+            return 'Review Version Candidate';
+        case 'reconnect_account':
+            return 'Reconnect Account';
+        case 'open_on_forkit':
+            return 'Open on Forkit.dev';
+        case 'defer':
+            return 'Ask Later';
+        case 'ignore':
+            return 'Do Not Register';
+        default:
+            return action.replaceAll('_', ' ');
+    }
+}
+function formatSmartInboxActionLabel(item) {
+    return formatSmartInboxActionValue(item.recommended_action, item.item_type, String(item.details_received_automatically.connectable_model_name || '').trim());
+}
+function printInboxGroup(label, items) {
+    if (items.length === 0)
+        return;
+    console.log(`${label}: ${items.length}`);
+    for (const item of items) {
+        console.log(`- ${item.display_name} | type=${item.item_type} | confidence=${item.confidence} | next=${formatSmartInboxActionLabel(item)}${item.matched_passport_gaid ? ` | match=${shortId(item.matched_passport_gaid)}` : ''}`);
+    }
+}
+function printSmartInbox(inbox) {
+    console.log(`[forkit-connect] Smart Registration Inbox generated_at=${inbox.summary.generated_at}`);
+    console.log(`Governance authority: website | user_api_key_required=${String(inbox.user_api_key_required)}`);
+    printInboxGroup('Ready to Connect', inbox.groups.ready_to_connect);
+    printInboxGroup('Needs Confirmation', inbox.groups.needs_confirmation);
+    printInboxGroup('Connected', inbox.groups.connected);
+    printInboxGroup('Ignored', inbox.groups.ignored);
+    if (inbox.summary.next_recommended_action) {
+        console.log(`Next recommended action: ${formatSmartInboxActionValue(inbox.summary.next_recommended_action)}`);
+    }
+}
+function printConnectStatusOverview(status) {
+    const sessionMissing = !status.device_paired && status.binding_state === 'active' && !status.credential_reconnect_needed;
+    console.log(JSON.stringify({
+        device_paired: status.device_paired,
+        workspace_id: status.workspace_id,
+        project_id: status.project_id,
+        binding_state: status.binding_state,
+        lifecycle_note: status.lifecycle_note,
+        daemon_status: status.daemon_status,
+        models_discovered: status.models_discovered,
+        agents_discovered: status.agents_discovered,
+        runtimes_discovered: status.runtimes_discovered,
+        paused_session_count: status.paused_session_count,
+        revoked_session_count: status.revoked_session_count,
+        credential_reconnect_needed: status.credential_reconnect_needed,
+        ready_to_connect_count: status.ready_to_connect_count,
+        needs_confirmation_count: status.needs_confirmation_count,
+        connected_count: status.connected_count,
+        c2_sync_pending: status.c2_sync_pending,
+        privacy_mode: status.privacy_mode,
+        next_recommended_action: status.next_recommended_action,
+        session_truth: sessionMissing ? 'missing_with_local_scope' : 'normal',
+    }, null, 2));
+}
+function printPublicStatusOverview(status) {
+    console.log('[forkit-connect] Status');
+    console.log(`- device_paired=${String(status.device_paired)}`);
+    console.log(`- workspace=${status.workspace_id || 'not selected'}`);
+    console.log(`- project=${status.project_id || 'not selected'}`);
+    console.log(`- daemon=${status.daemon_status}`);
+    console.log(`- models_discovered=${status.models_discovered}`);
+    console.log(`- agents_discovered=${status.agents_discovered}`);
+    console.log(`- runtimes_discovered=${status.runtimes_discovered}`);
+    console.log(`- ready_to_connect=${status.ready_to_connect_count}`);
+    console.log(`- needs_confirmation=${status.needs_confirmation_count}`);
+    console.log(`- connected=${status.connected_count}`);
+    console.log(`- c2_sync_pending=${status.c2_sync_pending}`);
+    console.log(`- privacy_mode=${status.privacy_mode}`);
+    if (status.lifecycle_note) {
+        console.log(`- note=${status.lifecycle_note}`);
+    }
+    if (!status.device_paired && status.binding_state === 'active') {
+        console.log('- warning=Local workspace/project scope exists, but the account session is missing. Re-login is required before governed actions can continue.');
+    }
+}
+function printPublicStatusGuidance(status, sessionState) {
+    if (sessionState === 'missing') {
+        console.log('- note=Local discovery is working. Sign in next to pair this device with your Forkit.dev account.');
+        console.log('- next=run forkit-connect login');
+        if (status.binding_state === 'active' && status.workspace_id && status.project_id) {
+            console.log('- warning=This device has local workspace/project scope saved, but it is not an active account session yet.');
+        }
+        return;
+    }
+    if (sessionState === 'expired') {
+        console.log('- note=Your local device is initialized, but the account session needs to be renewed.');
+        console.log('- next=run forkit-connect login');
+        return;
+    }
+    if (!status.device_paired) {
+        console.log('- note=Device identity is ready locally, but browser approval still needs to complete.');
+        console.log('- next=finish login approval on Forkit.dev, then rerun forkit-connect status');
+        return;
+    }
+    if (status.daemon_status === 'stopped') {
+        console.log('- note=Background sync is idle right now. This is expected until you start the local daemon.');
+        console.log('- next=run forkit-connect start');
+        return;
+    }
+    if (status.next_recommended_action) {
+        console.log(`- next_detail=${formatSmartInboxActionValue(status.next_recommended_action)}`);
+    }
+}
+async function checkBackendSessionState(service) {
+    const sessionRefValue = String(service.readSessionRef() || '').trim();
+    if (!sessionRefValue)
+        return 'missing';
+    const api = new api_1.ConnectApiClient({
+        baseUrl: DEFAULT_BASE_URL,
+        sessionRef: sessionRefValue,
+    });
+    const result = await api.getProfileAccess();
+    if (result.ok)
+        return 'authorized';
+    if (result.status === 401 || result.status === 403)
+        return 'expired';
+    return 'unavailable';
+}
+function normalizeModelSelector(raw) {
+    return raw.trim().toLowerCase();
+}
+function resolveSingleDetectedModelByName(service, rawName, digest) {
+    const state = service.getStateStore().readState();
+    const candidates = (state.detected_models || []).filter((item) => (item.status !== 'ignored'
+        && normalizeModelSelector(item.model) === normalizeModelSelector(rawName)
+        && (!digest || item.digest === digest)));
+    if (candidates.length === 1) {
+        return candidates[0];
+    }
+    return null;
+}
+async function promptSelection(label, options) {
+    if (!options.length)
+        return null;
+    if (!node_process_1.stdin.isTTY || !node_process_1.stdout.isTTY) {
+        const rl = (0, promises_1.createInterface)({ input: node_process_1.stdin, output: node_process_1.stdout });
+        try {
+            console.log(label);
+            options.forEach((option, index) => {
+                console.log(`  ${index + 1}. ${option.label}`);
+            });
+            const answer = (await rl.question('Choose number: ')).trim();
+            const index = Number(answer);
+            if (!Number.isFinite(index) || index < 1 || index > options.length) {
+                return null;
+            }
+            return options[index - 1]?.value ?? null;
+        }
+        finally {
+            rl.close();
+        }
+    }
+    (0, node_readline_1.emitKeypressEvents)(node_process_1.stdin);
+    const canUseRawMode = typeof node_process_1.stdin.setRawMode === 'function';
+    const previousRawMode = canUseRawMode ? node_process_1.stdin.isRaw : false;
+    if (canUseRawMode) {
+        node_process_1.stdin.setRawMode(true);
+    }
+    const maxVisibleOptions = 10;
+    let selectedIndex = 0;
+    let renderLineCount = 0;
+    const dim = '\u001B[2m';
+    const inverse = '\u001B[7m';
+    const reset = '\u001B[0m';
+    const hideCursor = '\u001B[?25l';
+    const showCursor = '\u001B[?25h';
+    const normalizedLabel = label.trim().endsWith(':') ? label.trim() : `${label.trim()}:`;
+    const render = () => {
+        if (renderLineCount > 0) {
+            node_process_1.stdout.write(`\u001B[${renderLineCount}A`);
+            node_process_1.stdout.write('\u001B[0J');
+        }
+        const startIndex = Math.max(0, Math.min(selectedIndex - Math.floor(maxVisibleOptions / 2), Math.max(0, options.length - maxVisibleOptions)));
+        const visibleOptions = options.slice(startIndex, startIndex + maxVisibleOptions);
+        const endIndex = startIndex + visibleOptions.length;
+        const lines = [
+            normalizedLabel,
+            '',
+            ...(startIndex > 0 ? [`${dim}  …${reset}`] : []),
+            ...visibleOptions.map((option, offset) => {
+                const absoluteIndex = startIndex + offset;
+                if (absoluteIndex === selectedIndex) {
+                    return `> ${inverse}${option.label}${reset}`;
+                }
+                return `  ${option.label}`;
+            }),
+            ...(endIndex < options.length ? [`${dim}  …${reset}`] : []),
+            '',
+            `${dim}↑/↓ move • Enter select • Esc cancel${reset}`,
+        ];
+        node_process_1.stdout.write(`${hideCursor}${lines.join('\n')}\n`);
+        renderLineCount = lines.length;
+    };
+    render();
+    // Drain any keypresses buffered during async operations (e.g. discovery scan).
+    // Without this, keys pressed while loading fire immediately against the new listener
+    // and cause phantom selections — the prompt appears to flash through 10–18 times.
+    await new Promise((resolve) => setTimeout(resolve, 40));
+    return await new Promise((resolve) => {
+        const cleanup = (value) => {
+            node_process_1.stdin.off('keypress', onKeypress);
+            if (canUseRawMode) {
+                node_process_1.stdin.setRawMode(previousRawMode === true);
+            }
+            node_process_1.stdout.write(`\u001B[${renderLineCount}A`);
+            node_process_1.stdout.write(`\u001B[0J${showCursor}`);
+            if (value) {
+                console.log(`${label}: ${options[selectedIndex]?.label || value}`);
+            }
+            resolve(value);
+        };
+        const moveSelection = (delta) => {
+            selectedIndex = (selectedIndex + delta + options.length) % options.length;
+            render();
+        };
+        const onKeypress = (_value, key) => {
+            if (key.ctrl && key.name === 'c') {
+                cleanup(null);
+                return;
+            }
+            if (key.name === 'up' || key.name === 'k') {
+                moveSelection(-1);
+                return;
+            }
+            if (key.name === 'down' || key.name === 'j') {
+                moveSelection(1);
+                return;
+            }
+            if (key.name === 'return' || key.name === 'enter') {
+                cleanup(options[selectedIndex]?.value ?? null);
+                return;
+            }
+            if (key.name === 'escape' || key.name === 'q') {
+                cleanup(null);
+            }
+        };
+        node_process_1.stdin.on('keypress', onKeypress);
+    });
+}
+async function promptText(question, options) {
+    const rl = (0, promises_1.createInterface)({ input: node_process_1.stdin, output: node_process_1.stdout });
+    try {
+        const answer = (await rl.question(question)).trim();
+        if (!answer && options?.allowEmpty !== true) {
+            return null;
+        }
+        return answer;
+    }
+    finally {
+        rl.close();
+    }
+}
+function buildCreateAccountUrl() {
+    return `${DEFAULT_BASE_URL}/auth?returnTo=${encodeURIComponent('/connect')}`;
+}
+async function openUrlWithFallback(url, message) {
+    const opened = await openUrl(url);
+    if (opened) {
+        console.log('[forkit-connect] Browser opened.');
+        return;
+    }
+    if (message) {
+        console.log(message);
+    }
+    console.log(url);
+}
+function printTrayStatus(status, menu) {
+    console.log(JSON.stringify({
+        daemon_running: status.daemonRunning,
+        detected_models: status.detectedModels,
+        detected_agents: status.detectedAgents,
+        shadow_or_unconnected_count: status.shadowOrUnconnectedCount,
+        pulse_status: status.pulseStatus,
+        c2_pending_count: status.c2PendingCount,
+        recommended_next_action: status.recommendedNextAction,
+        recommended_next_step: status.recommendedNextAction === 'connect_model'
+            ? 'Run `forkit-connect connect <model>` to prepare a Passport draft.'
+            : status.recommendedNextAction === 'link_agent_model'
+                ? 'Run `forkit-connect agent review` to connect an agent and link it to a model.'
+                : status.recommendedNextAction === 'review_agent'
+                    ? 'Run `forkit-connect agent review` to inspect detected AI agents.'
+                    : status.recommendedNextAction === 'view_pulse_history'
+                        ? 'Run `forkit-connect pulse history --limit 10` to review recent runtime health.'
+                        : status.recommendedNextAction === 'sync_c2'
+                            ? 'Sign in first, then sync metadata-only lifecycle updates.'
+                            : null,
+        status_color: status.statusColor,
+        tray_menu: menu,
+    }, null, 2));
+}
+async function run() {
+    const args = process.argv.slice(2);
+    const command = args[0];
+    const service = new service_1.ConnectV1Service();
+    const sessionRef = getArg('--session-ref');
+    const workspaceId = getArg('--workspace');
+    const projectId = getArg('--project');
+    const descriptionArg = getArg('--description');
+    const projectNameArg = getArg('--project-name');
+    const projectDescriptionArg = getArg('--project-description');
+    const modelName = getArg('--model');
+    const draftId = getArg('--draft');
+    const intervalSecondsArg = getArg('--interval-seconds');
+    const limitArg = getArg('--limit');
+    if (sessionRef !== null) {
+        service.setSessionRef(sessionRef);
+    }
+    if (!command) {
+        showUsage();
+        return;
+    }
+    if (isHelpCommand(command)) {
+        showUsage();
+        return;
+    }
+    const runPublicConnectInit = () => {
+        printConnectInit(service.initializeConnectIdentity());
+    };
+    const runPublicConnectStatus = async () => {
+        const sessionState = await checkBackendSessionState(service);
+        if (service.readSessionRef()) {
+            try {
+                await service.refreshEffectiveBinding();
+            }
+            catch {
+                // Status remains useful with the last local binding snapshot.
+            }
+        }
+        const overview = service.getConnectStatusOverview();
+        const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+        const localScopeCached = Boolean(String(overview.workspace_id || '').trim() || String(overview.project_id || '').trim());
+        const displayOverview = accountTrusted
+            ? overview
+            : {
+                ...overview,
+                workspace_id: null,
+                project_id: null,
+                lifecycle_note: localScopeCached
+                    ? 'Local workspace/project scope is cached on this device, but account login is required before governed actions can continue.'
+                    : 'Account login is required before governed actions can continue.',
+            };
+        if (hasFlag('--json')) {
+            printJson({
+                ...overview,
+                workspace_id: accountTrusted ? overview.workspace_id : null,
+                project_id: accountTrusted ? overview.project_id : null,
+                session_state: sessionState,
+                session_truth: accountTrusted ? 'account_verified_or_offline' : 'local_scope_cached_login_required',
+                local_scope_cached: !accountTrusted && localScopeCached,
+                binding_truth: accountTrusted ? 'account_binding_active' : 'account_login_required',
+            });
+            return;
+        }
+        printPublicStatusOverview(displayOverview);
+        console.log(`- session=${sessionState}`);
+        console.log(`- binding_truth=${accountTrusted ? 'account_binding_active' : 'account_login_required'}`);
+        if (!accountTrusted && localScopeCached) {
+            console.log('- local_scope_cached=true');
+        }
+        printPublicStatusGuidance(displayOverview, sessionState);
+    };
+    const runPublicConnectInbox = () => {
+        const inbox = service.buildSmartRegistrationInbox();
+        if (hasFlag('--json')) {
+            printJson(inbox);
+            return;
+        }
+        printSmartInbox(inbox);
+    };
+    const runPublicCollectedChanges = () => {
+        const rawLimit = limitArg !== null ? Number(limitArg) : 20;
+        const historyLimit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : 20;
+        const state = service.getStateStore().readState();
+        const paths = service.getStateStore().getPaths();
+        const recentEvidence = [...state.evidence_events].slice(-historyLimit).reverse();
+        const recentPulse = service.getPulseHistory(historyLimit);
+        const evidenceTypeCounts = Object.fromEntries([...state.evidence_events.reduce((map, event) => {
+                map.set(event.type, (map.get(event.type) || 0) + 1);
+                return map;
+            }, new Map()).entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0])));
+        if (hasFlag('--json')) {
+            printJson({
+                state_paths: paths,
+                summary: {
+                    evidence_events: state.evidence_events.length,
+                    pulse_events: state.pulse_events.length,
+                    sync_queue: state.sync_queue.length,
+                    pending_reviews: state.pending_reviews.length,
+                    evolution_candidates: state.evolution_candidates.length,
+                    c2_events: state.c2_events.length,
+                    detected_models: state.detected_models.length,
+                    detected_runtimes: state.detected_runtimes.length,
+                    detected_agents: state.detected_agents.length,
+                },
+                evidence_types: evidenceTypeCounts,
+                recent_evidence_events: recentEvidence,
+                recent_pulse_events: recentPulse,
+                pending_sync_queue: state.sync_queue.slice(0, historyLimit),
+                note: 'Local review evidence and runtime signals are best-effort local observations. Synced queue items are the backend-authoritative subset.',
+            });
+            return;
+        }
+        printCollectedChanges(service, historyLimit);
+    };
+    const runPublicScan = async () => {
+        const ignoreModel = getArg('--ignore-model');
+        const ignoreDigest = getArg('--ignore-digest');
+        if (ignoreModel && ignoreDigest) {
+            const ignored = service.markModelIgnored(ignoreModel, ignoreDigest);
+            if (!ignored) {
+                console.error(`[forkit-connect] Model not found for ignore: ${ignoreModel} ${ignoreDigest}`);
+                process.exitCode = 2;
+                return;
+            }
+            console.log(`[forkit-connect] Ignored model: ${ignoreModel} (${ignoreDigest})`);
+            return;
+        }
+        const result = await service.runDiscoveryCycle();
+        console.log(result.message);
+        for (const runtime of result.runtimes) {
+            const runtimeStatus = runtime.ok ? 'detected' : 'unavailable';
+            const errorPart = runtime.error ? ` | error=${runtime.error}` : '';
+            console.log(`- runtime=${runtime.runtime} | status=${runtimeStatus} | endpoint=${runtime.endpoint} | models=${runtime.modelsFound}${errorPart}`);
+        }
+        for (const model of result.models) {
+            const modelIdPart = model.modelId ? ` | id=${model.modelId}` : '';
+            console.log(`- ${model.model} | runtime=${model.runtime} | digest=${model.digest}${modelIdPart} | source=${model.sourceLabel} | endpoint=${model.sourceEndpoint}`);
+        }
+        console.log(`[forkit-connect] Detected new=${result.newModels} already_known=${result.alreadyKnownModels} duplicates_skipped=${result.duplicateDiscoveriesSkipped}`);
+        printDiscoverySummary(result.summary);
+        console.log(`[forkit-connect] Queue queued=${result.queue.queued} skipped_pending=${result.queue.skippedPending} skipped_bound=${result.queue.skippedBound} skipped_duplicates=${result.queue.skippedDuplicate}`);
+        const heartbeatGaid = getArg('--heartbeat-gaid');
+        const heartbeatKey = getArg('--heartbeat-key');
+        if (heartbeatGaid && heartbeatKey) {
+            const queueId = service.queueHeartbeatRuntimeSignal(heartbeatGaid, heartbeatKey);
+            if (queueId) {
+                console.log(`[forkit-connect] Queued heartbeat runtime signal: ${queueId}`);
+            }
+        }
+        console.log(`[forkit-connect] Queue processed=${result.sync.processed} succeeded=${result.sync.succeeded} failed=${result.sync.failed}`);
+        if (!result.ok) {
+            process.exitCode = 2;
+        }
+    };
+    const runPublicUpdateCheck = async () => {
+        const updateCheck = await (0, update_1.checkForUpdates)();
+        const lines = (0, update_1.formatUpdateCheckLines)(updateCheck);
+        printUpdateCheckLines(lines, !updateCheck.ok || (updateCheck.ok && updateCheck.availability === 'required-update'));
+        if (!updateCheck.ok || updateCheck.availability === 'required-update') {
+            process.exitCode = 2;
+        }
+    };
+    const runPublicLogout = () => {
+        const currentSessionRef = String(service.readSessionRef() || '').trim();
+        const hadEnvironmentSession = Boolean(String(process.env.FORKIT_CONNECT_SESSION_REF || '').trim());
+        delete process.env.FORKIT_CONNECT_SESSION_REF;
+        try {
+            service.setSessionRef(null);
+            console.log('[forkit-connect] Logged out. Local discovery remains available on this device.');
+            if (hadEnvironmentSession) {
+                console.log('[forkit-connect] The in-process fallback session was cleared for this run.');
+            }
+            return;
+        }
+        catch (error) {
+            if (error instanceof credential_store_1.ConnectCredentialStoreError) {
+                if (currentSessionRef) {
+                    console.log('[forkit-connect] Logged out from the current interactive run.');
+                    console.log('[forkit-connect] If you previously exported a session in your shell, remove it there with:');
+                    console.log('unset FORKIT_CONNECT_SESSION_REF');
+                    return;
+                }
+                console.log('[forkit-connect] No stored session found.');
+                console.log('[forkit-connect] If you previously exported a session in this shell, remove it with:');
+                console.log('unset FORKIT_CONNECT_SESSION_REF');
+                return;
+            }
+            throw error;
+        }
+    };
+    const activateEnvironmentSessionFallback = async (token) => {
+        process.env.FORKIT_CONNECT_SESSION_REF = token;
+        service.initializeConnectIdentity();
+        try {
+            await service.refreshEffectiveBinding();
+        }
+        catch {
+            // Keep the current process authenticated via environment fallback even if backend refresh is temporarily unavailable.
+        }
+    };
+    const runPublicLogin = async () => {
+        const noBrowser = hasFlag('--no-browser');
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: null,
+        });
+        const started = await api.startDeviceConnect(service.buildDeviceConnectStartPayload());
+        if (!started.ok || !isDeviceConnectStartResponse(started.body)) {
+            console.error(`[forkit-connect] Device login start failed (${started.status}).`);
+            if (started.body) {
+                console.error(typeof started.body === 'string' ? started.body : JSON.stringify(started.body));
+            }
+            process.exitCode = 2;
+            return false;
+        }
+        const start = started.body;
+        printDeviceLoginInstructions(start);
+        if (!noBrowser && hasLinuxGuiSession()) {
+            const opened = await openUrl(start.verification_url);
+            if (opened) {
+                console.log('[forkit-connect] Browser opened. Approve the device there, then return here.');
+            }
+            else {
+                console.log('[forkit-connect] Browser could not be opened automatically. Use the URL above manually.');
+            }
+        }
+        else if (!noBrowser && process.platform === 'linux') {
+            console.log('[forkit-connect] Headless Linux session detected. Open the verification URL manually.');
+        }
+        const deadline = new Date(start.expires_at).getTime();
+        const pollEveryMs = Math.max(1000, Math.floor(start.poll_interval_seconds * 1000));
+        while (Date.now() < deadline) {
+            await sleep(pollEveryMs);
+            const polled = await api.pollDeviceConnect(start.device_code);
+            if (isPollApproved(polled.body)) {
+                try {
+                    service.setSessionRef(polled.body.connect_access_token);
+                    await service.refreshEffectiveBinding();
+                    const displayName = getSessionDisplayName(polled.body.connect_access_token);
+                    console.log(displayName
+                        ? `[forkit-connect] Login approved. Welcome, ${displayName}. Session credentials stored securely.`
+                        : '[forkit-connect] Login approved. Session credentials stored securely.');
+                    return true;
+                }
+                catch (error) {
+                    if (error instanceof credential_store_1.ConnectCredentialStoreError) {
+                        await activateEnvironmentSessionFallback(polled.body.connect_access_token);
+                        printSessionExportFallback(polled.body.connect_access_token);
+                        const displayName = getSessionDisplayName(polled.body.connect_access_token);
+                        console.log(displayName
+                            ? `[forkit-connect] Welcome, ${displayName}. Continuing with an environment-backed session for this run.`
+                            : '[forkit-connect] Continuing with an environment-backed session for this run.');
+                        process.exitCode = 0;
+                        return true;
+                    }
+                    throw error;
+                }
+            }
+            if (isPollPending(polled.body)) {
+                continue;
+            }
+            if (polled.status === 410) {
+                console.error('[forkit-connect] Device login expired before approval.');
+                process.exitCode = 2;
+                return false;
+            }
+            if (polled.status === 403) {
+                console.error('[forkit-connect] Device login was denied.');
+                process.exitCode = 2;
+                return false;
+            }
+            if (polled.status === 409) {
+                console.error('[forkit-connect] Device code already consumed. Start login again.');
+                process.exitCode = 2;
+                return false;
+            }
+            console.error(`[forkit-connect] Poll failed (${polled.status}).`);
+            if (polled.body) {
+                console.error(typeof polled.body === 'string' ? polled.body : JSON.stringify(polled.body));
+            }
+            process.exitCode = 2;
+            return false;
+        }
+        console.error('[forkit-connect] Device login timed out. Start login again.');
+        process.exitCode = 2;
+        return false;
+    };
+    const handleWorkspaceError = (error) => {
+        const message = error instanceof Error ? error.message : 'workspace_command_failed';
+        if (message === 'NOT_AUTHENTICATED') {
+            console.error('Not authenticated. Run forkit-connect login first.');
+        }
+        else if (message.startsWith('WORKSPACE_LIST_FAILED:')) {
+            console.error(`Workspace listing failed (${message.split(':')[1]}).`);
+        }
+        else {
+            console.error(message);
+        }
+        process.exitCode = 2;
+    };
+    const buildWorkspaceStatusPayload = async () => {
+        const sessionState = await checkBackendSessionState(service);
+        if (service.readSessionRef()) {
+            try {
+                await service.refreshEffectiveBinding();
+            }
+            catch {
+                // Keep local scope view available.
+            }
+        }
+        const overview = service.getConnectStatusOverview();
+        const operatingMode = resolveOperatingMode(service);
+        const accountTrusted = sessionState === 'authorized' || sessionState === 'unavailable';
+        const localScopeCached = Boolean(String(overview.workspace_id || '').trim() || String(overview.project_id || '').trim());
+        return {
+            session_state: sessionState,
+            operating_mode: operatingMode.mode,
+            tier: operatingMode.tier,
+            workspace_id: accountTrusted ? overview.workspace_id : null,
+            project_id: accountTrusted ? overview.project_id : null,
+            binding_state: accountTrusted ? overview.binding_state : 'login_required',
+            lifecycle_note: accountTrusted
+                ? overview.lifecycle_note
+                : localScopeCached
+                    ? 'Local workspace/project scope is cached on this device, but account login is required before governed actions can continue.'
+                    : 'Account login is required before governed workspace/project actions can continue.',
+            daemon_status: overview.daemon_status,
+            ready_to_connect_count: overview.ready_to_connect_count,
+            needs_confirmation_count: overview.needs_confirmation_count,
+            connected_count: overview.connected_count,
+        };
+    };
+    const renderInteractiveStatusScreen = async (sessionState) => {
+        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const displayName = accountLimits?.displayName ?? getSessionDisplayName(service.readSessionRef());
+        renderInteractiveScreen('Forkit Connect', {
+            subtitle: displayName ? `Welcome back, ${displayName}` : 'Interactive overview',
+            sections: buildInteractiveOverviewSections(service, sessionState, accountLimits),
+            footerLines: ['Select an action below.'],
+        });
+    };
+    const renderInteractiveChangesScreen = () => {
+        renderInteractiveScreen('Collected Changes', {
+            subtitle: 'Local evidence, signal history, and queued sync work',
+            sections: buildInteractiveChangesSections(service, 12),
+            footerLines: ['Local evidence is advisory until it syncs to Forkit.dev.'],
+        });
+    };
+    const renderInteractiveWorkspaceScreen = async () => {
+        const payload = await buildWorkspaceStatusPayload();
+        renderInteractiveScreen('Workspace Scope', {
+            subtitle: 'Current workspace and project selection',
+            sections: [
+                {
+                    title: 'Scope',
+                    lines: [
+                        shellLine('Mode', payload.operating_mode),
+                        shellLine('Tier', payload.tier || 'unknown'),
+                        shellLine('Workspace', formatScopeReferenceLabel(payload.workspace_id, 'workspace')),
+                        shellLine('Project', formatScopeReferenceLabel(payload.project_id, 'project')),
+                        shellLine('Session', payload.session_state),
+                        shellLine('Binding state', payload.binding_state),
+                        shellLine('Daemon', payload.daemon_status),
+                    ],
+                },
+                {
+                    title: 'Queue',
+                    lines: [
+                        shellLine('Ready to connect', payload.ready_to_connect_count),
+                        shellLine('Needs confirmation', payload.needs_confirmation_count),
+                        shellLine('Connected', payload.connected_count),
+                        ...(payload.lifecycle_note ? [shellLine('Note', payload.lifecycle_note)] : []),
+                    ],
+                },
+            ],
+            footerLines: ['Select a workspace action below.'],
+        });
+    };
+    const runInteractiveAutoRefresh = async () => {
+        // Only run discovery and binding refresh when the user has a session.
+        // Pre-login, these calls add significant startup latency with no user benefit.
+        if (service.readSessionRef()) {
+            try {
+                await service.runDiscoveryCycle();
+            }
+            catch {
+                // Keep the interactive shell usable even if local discovery has transient issues.
+            }
+            try {
+                await service.refreshEffectiveBinding();
+            }
+            catch {
+                // Use the latest local binding snapshot when backend refresh is unavailable.
+            }
+        }
+    };
+    const runInteractiveWorkspaceMenu = async () => {
+        while (true) {
+            try {
+                await renderInteractiveWorkspaceScreen();
+                const workspaceAction = await promptSelection('Workspace actions', [
+                    { value: 'select', label: 'Select workspace and project' },
+                    { value: 'create', label: 'Create workspace' },
+                    { value: 'back', label: 'Back' },
+                ]);
+                if (!workspaceAction || workspaceAction === 'back') {
+                    return;
+                }
+                if (workspaceAction === 'select') {
+                    await runWorkspaceSelect();
+                }
+                else if (workspaceAction === 'create') {
+                    await runWorkspaceCreate();
+                }
+                if (!process.exitCode || process.exitCode === 0) {
+                    continue;
+                }
+                return;
+            }
+            catch (error) {
+                handleWorkspaceError(error);
+                return;
+            }
+        }
+    };
+    const ensureInteractiveWorkspaceScope = async () => {
+        try {
+            await service.refreshEffectiveBinding();
+        }
+        catch {
+            // Use local binding when backend refresh is temporarily unavailable.
+        }
+        const operatingMode = resolveOperatingMode(service);
+        const currentState = service.getStateStore().readState();
+        const boundWorkspaceId = String(currentState.workspace_binding.workspaceId || '').trim();
+        const boundProjectId = String(currentState.project_binding.projectId || '').trim();
+        if (operatingMode.mode !== 'governed') {
+            if (!boundWorkspaceId || !boundProjectId) {
+                console.log('[forkit-connect] Solo mode active. Personal registration can continue without workspace/project scope.');
+            }
+            return true;
+        }
+        if (boundWorkspaceId && boundProjectId) {
+            return true;
+        }
+        console.log('[forkit-connect] Governed scope is required before registration.');
+        try {
+            await runWorkspaceSelect();
+        }
+        catch (error) {
+            handleWorkspaceError(error);
+            return false;
+        }
+        if (process.exitCode && process.exitCode !== 0) {
+            return false;
+        }
+        process.exitCode = 0;
+        const refreshedState = service.getStateStore().readState();
+        return Boolean(String(refreshedState.workspace_binding.workspaceId || '').trim()
+            && String(refreshedState.project_binding.projectId || '').trim());
+    };
+    const resolveInteractiveModel = (selector) => {
+        const state = service.getStateStore().readState();
+        return state.detected_models.find((model) => model.discoveryHash === selector)
+            ?? state.detected_models.find((model) => model.model === selector)
+            ?? state.detected_models.find((model) => model.discoveryHash.startsWith(selector))
+            ?? null;
+    };
+    const createWorkspaceInteractively = async (api) => {
+        const workspaceName = await promptText('Workspace name: ');
+        if (!workspaceName) {
+            console.error('Workspace creation cancelled.');
+            process.exitCode = 2;
+            return null;
+        }
+        const workspaceDescription = await promptText('Workspace description (optional): ', { allowEmpty: true });
+        const result = await api.createWorkspace({
+            name: workspaceName,
+            ...(workspaceDescription ? { description: workspaceDescription } : {}),
+        });
+        if (!result.ok || !isWorkspaceCreateResponse(result.body)) {
+            console.error(`Workspace creation failed (${result.status}).`);
+            process.exitCode = 2;
+            return null;
+        }
+        const workspace = result.body.workspace && typeof result.body.workspace === 'object'
+            ? result.body.workspace
+            : null;
+        if (!String(workspace?.id || '').trim()) {
+            console.error('Workspace creation returned no workspace id.');
+            process.exitCode = 2;
+            return null;
+        }
+        await loadCliAccountLimits({ force: true }).catch(() => null);
+        return workspace;
+    };
+    const chooseInteractiveWorkspaceProject = async () => {
+        const operatingMode = ensureGovernedMode();
+        if (!operatingMode) {
+            return null;
+        }
+        const api = buildWorkspaceApi();
+        const { workspaces } = await runWorkspaceList();
+        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const displayName = accountLimits?.displayName ?? getSessionDisplayName(service.readSessionRef());
+        let selectedWorkspace = null;
+        const currentState = service.getStateStore().readState();
+        const boundWorkspaceId = String(currentState.workspace_binding.workspaceId || '').trim();
+        const boundProjectId = String(currentState.project_binding.projectId || '').trim();
+        const boundWorkspace = boundWorkspaceId
+            ? workspaces.find((workspace) => String(workspace.id || '').trim() === boundWorkspaceId) ?? null
+            : null;
+        const availableWorkspaceChoices = boundWorkspaceId
+            ? workspaces.filter((workspace) => String(workspace.id || '').trim() !== boundWorkspaceId)
+            : workspaces;
+        if (workspaces.length === 0) {
+            renderInteractiveScreen('Choose Workspace', {
+                subtitle: displayName ? `Welcome, ${displayName}` : 'No existing workspaces yet',
+                sections: [
+                    {
+                        title: 'Next Step',
+                        lines: [shellListLine('Create a workspace first, then create or choose a project inside it.')],
+                    },
+                    ...(accountLimits ? [{
+                            title: 'Account Limits',
+                            lines: [
+                                shellLine('Workspaces', formatRemainingLimit(accountLimits.workspaceLimit, accountLimits.workspacesUsed, 'workspace')),
+                                shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
+                            ],
+                        }] : []),
+                ],
+            });
+            selectedWorkspace = await createWorkspaceInteractively(api);
+            if (!selectedWorkspace) {
+                return null;
+            }
+        }
+        else {
+            renderInteractiveScreen('Choose Workspace', {
+                subtitle: displayName ? `Welcome, ${displayName}` : 'Use an existing workspace or create a new one',
+                sections: [
+                    ...(boundWorkspaceId && boundProjectId ? [{
+                            title: 'Current Scope',
+                            lines: [
+                                shellLine('Workspace', boundWorkspace ? summarizeWorkspaceLabel(boundWorkspace) : formatScopeReferenceLabel(boundWorkspaceId, 'workspace')),
+                                shellLine('Project', formatScopeReferenceLabel(boundProjectId, 'project')),
+                                shellListLine('You can keep this scope or switch to another workspace/project below.'),
+                            ],
+                        }] : []),
+                    {
+                        title: 'Available Workspaces',
+                        lines: availableWorkspaceChoices.slice(0, 8).map((workspace) => shellListLine(summarizeWorkspaceLabel(workspace))),
+                    },
+                    ...(accountLimits ? [{
+                            title: 'Account Limits',
+                            lines: [
+                                shellLine('Workspaces', formatRemainingLimit(accountLimits.workspaceLimit, accountLimits.workspacesUsed, 'workspace')),
+                                shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
+                            ],
+                        }] : []),
+                ],
+                footerLines: ['Choose a workspace below.'],
+            });
+            const selectedWorkspaceId = await promptSelection('Choose workspace', [
+                ...(boundWorkspace
+                    ? [{ value: boundWorkspaceId, label: `Keep current workspace · ${summarizeWorkspaceLabel(boundWorkspace)}` }]
+                    : []),
+                ...availableWorkspaceChoices.map((workspace) => ({
+                    value: String(workspace.id || ''),
+                    label: summarizeWorkspaceLabel(workspace),
+                })),
+                { value: '__create_workspace__', label: 'Create new workspace' },
+                { value: 'back', label: 'Back' },
+            ]);
+            if (!selectedWorkspaceId || selectedWorkspaceId === 'back') {
+                return null;
+            }
+            if (selectedWorkspaceId === '__create_workspace__') {
+                selectedWorkspace = await createWorkspaceInteractively(api);
+                if (!selectedWorkspace) {
+                    return null;
+                }
+            }
+            else {
+                selectedWorkspace = workspaces.find((workspace) => String(workspace.id || '') === selectedWorkspaceId) ?? null;
+            }
+        }
+        const workspaceIdValue = String(selectedWorkspace?.id || '').trim();
+        const workspaceLabel = selectedWorkspace ? summarizeWorkspaceLabel(selectedWorkspace) : String(workspaceIdValue || 'Selected workspace').trim();
+        if (!workspaceIdValue) {
+            console.error('Workspace selection returned no workspace id.');
+            process.exitCode = 2;
+            return null;
+        }
+        const projectsResult = await api.getWorkspaceProjects(workspaceIdValue);
+        if (!projectsResult.ok || !isWorkspaceProjectsResponse(projectsResult.body)) {
+            console.error(`Project listing failed (${projectsResult.status}).`);
+            process.exitCode = 2;
+            return null;
+        }
+        const projects = Array.isArray(projectsResult.body.projects) ? projectsResult.body.projects : [];
+        let selectedProject = null;
+        const boundProject = boundWorkspaceId === workspaceIdValue && boundProjectId
+            ? projects.find((project) => String(project.id || '').trim() === boundProjectId) ?? null
+            : null;
+        const availableProjectChoices = boundProject
+            ? projects.filter((project) => String(project.id || '').trim() !== boundProjectId)
+            : projects;
+        if (projects.length === 0) {
+            renderInteractiveScreen('Choose Project', {
+                subtitle: workspaceLabel,
+                sections: [
+                    {
+                        title: 'Next Step',
+                        lines: [shellListLine('This workspace has no projects yet, so create the first project now.')],
+                    },
+                    ...(accountLimits ? [{
+                            title: 'Account Limits',
+                            lines: [
+                                shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
+                            ],
+                        }] : []),
+                ],
+            });
+            selectedProject = await createProjectInWorkspace(api, workspaceIdValue, { interactivePrompt: true });
+            if (!selectedProject?.id) {
+                return null;
+            }
+        }
+        else {
+            renderInteractiveScreen('Choose Project', {
+                subtitle: workspaceLabel,
+                sections: [
+                    ...(boundWorkspaceId === workspaceIdValue && boundProjectId ? [{
+                            title: 'Current Scope',
+                            lines: [
+                                shellLine('Current project', boundProject ? summarizeProjectLabel(boundProject) : formatScopeReferenceLabel(boundProjectId, 'project')),
+                                shellListLine('You can keep this project or switch to another one below.'),
+                            ],
+                        }] : []),
+                    {
+                        title: 'Available Projects',
+                        lines: availableProjectChoices.slice(0, 8).map((project) => shellListLine(summarizeProjectLabel(project))),
+                    },
+                    ...(accountLimits ? [{
+                            title: 'Account Limits',
+                            lines: [
+                                shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
+                            ],
+                        }] : []),
+                ],
+                footerLines: ['Choose a project below.'],
+            });
+            const selectedProjectId = await promptSelection('Choose project', [
+                ...(boundProject
+                    ? [{ value: boundProjectId, label: `Keep current project · ${summarizeProjectLabel(boundProject)}` }]
+                    : []),
+                ...availableProjectChoices.map((project) => ({
+                    value: String(project.id || ''),
+                    label: summarizeProjectLabel(project),
+                })),
+                { value: '__create_project__', label: 'Create new project' },
+                { value: 'back', label: 'Back' },
+            ]);
+            if (!selectedProjectId || selectedProjectId === 'back') {
+                return null;
+            }
+            if (selectedProjectId === '__create_project__') {
+                selectedProject = await createProjectInWorkspace(api, workspaceIdValue, { interactivePrompt: true });
+                if (!selectedProject?.id) {
+                    return null;
+                }
+            }
+            else {
+                selectedProject = projects.find((project) => String(project.id || '') === selectedProjectId) ?? null;
+            }
+        }
+        const projectIdValue = String(selectedProject?.id || '').trim();
+        const projectLabel = selectedProject ? summarizeProjectLabel(selectedProject) : String(projectIdValue || 'Selected project').trim();
+        if (!projectIdValue) {
+            console.error('Project selection returned no project id.');
+            process.exitCode = 2;
+            return null;
+        }
+        await service.bindWorkspaceProject(workspaceIdValue, projectIdValue);
+        process.exitCode = 0;
+        return {
+            workspaceId: workspaceIdValue,
+            projectId: projectIdValue,
+            workspaceLabel,
+            projectLabel,
+        };
+    };
+    const loadInteractiveDraftPassportContext = async () => {
+        const sessionRefValue = String(service.readSessionRef() || '').trim();
+        if (!sessionRefValue) {
+            return { drafts: [], passports: [] };
+        }
+        const api = buildWorkspaceApi();
+        const [draftsResult, passportsResult] = await Promise.all([
+            api.getPassportDrafts(),
+            api.getPassportsMine(20),
+        ]);
+        const drafts = draftsResult.ok && isPassportDraftListResponse(draftsResult.body)
+            ? Array.isArray(draftsResult.body.drafts) ? draftsResult.body.drafts : []
+            : [];
+        const passports = passportsResult.ok ? readPassportList(passportsResult.body) : [];
+        return { drafts, passports };
+    };
+    const chooseInteractiveRegistrationScope = async (targetSelector) => {
+        const storedSessionRef = String(service.readSessionRef() || '').trim();
+        if (!storedSessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return null;
+        }
+        const targetModel = resolveInteractiveModel(targetSelector);
+        if (!targetModel) {
+            console.error('Model not found in local detected models. Run forkit-connect scan first.');
+            process.exitCode = 2;
+            return null;
+        }
+        const currentState = service.getStateStore().readState();
+        const boundWorkspaceId = String(currentState.workspace_binding.workspaceId || '').trim();
+        const boundProjectId = String(currentState.project_binding.projectId || '').trim();
+        const workspacePrepared = boundWorkspaceId && boundProjectId;
+        const accountLimits = await loadCliAccountLimits().catch(() => null);
+        const displayName = accountLimits?.displayName ?? getSessionDisplayName(service.readSessionRef());
+        renderInteractiveScreen('Register Passport', {
+            subtitle: targetModel.model,
+            sections: [
+                {
+                    title: 'Model',
+                    lines: [
+                        shellListLine(formatModelFriendlyExplanation(targetModel)),
+                        shellLine('Runtime', targetModel.runtimeName || targetModel.runtime),
+                        shellLine('Size', deriveModelSizeLabel(targetModel.sizeBytes)),
+                    ],
+                },
+                {
+                    title: 'Choose Scope',
+                    lines: [
+                        shellListLine('Solo  — personal registration, visible only to you.'),
+                        shellListLine('Workspace  — register under a workspace and project. You will choose or create them next.'),
+                    ],
+                },
+                ...(accountLimits ? [{
+                        title: 'Account Limits',
+                        lines: [
+                            shellLine('Workspaces', formatRemainingLimit(accountLimits.workspaceLimit, accountLimits.workspacesUsed, 'workspace')),
+                            shellLine('Projects', formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')),
+                        ],
+                    }] : []),
+            ],
+            footerLines: ['Choose Solo or Workspace below.'],
+        });
+        const scopeChoice = await promptSelection('Choose registration mode', [
+            { value: 'solo', label: 'Solo  — personal registration on this device' },
+            { value: 'workspace', label: 'Workspace  — select existing or create new workspace / project' },
+            { value: 'back', label: 'Back' },
+        ]);
+        if (!scopeChoice || scopeChoice === 'back') {
+            return null;
+        }
+        let workspaceSelection = null;
+        if (scopeChoice === 'workspace') {
+            workspaceSelection = await chooseInteractiveWorkspaceProject();
+            if (!workspaceSelection) {
+                return null;
+            }
+        }
+        const registrationContext = await loadInteractiveDraftPassportContext();
+        renderInteractiveScreen('Choose Draft Or Passport', {
+            subtitle: displayName ? `Welcome, ${displayName}` : targetModel.model,
+            sections: [
+                {
+                    title: 'Existing Drafts',
+                    lines: registrationContext.drafts.length
+                        ? registrationContext.drafts.slice(0, 3).map((draft) => shellListLine(formatDraftLine(draft).replace(/^-\s*/, '')))
+                        : [shellListLine('No existing drafts found for this account right now.')],
+                },
+                {
+                    title: 'Existing Passports',
+                    lines: registrationContext.passports.length
+                        ? registrationContext.passports.slice(0, 3).map((passport) => shellListLine(formatPassportLine(passport).replace(/^-\s*/, '')))
+                        : [shellListLine('No existing published passports found for this account right now.')],
+                },
+                ...(accountLimits ? [{
+                        title: 'Account Limits',
+                        lines: [
+                            shellLine('Drafts', formatRemainingLimit(accountLimits.draftLimit, accountLimits.draftsUsed, 'draft')),
+                            shellLine('Private passports', formatRemainingLimit(accountLimits.privatePassportsLimit, accountLimits.privatePassportsUsed, 'private passport')),
+                        ],
+                    }] : []),
+            ],
+            footerLines: ['Choose whether to stop at a draft or try to publish a passport now.'],
+        });
+        const destinationChoice = await promptSelection('Choose destination', [
+            { value: 'draft', label: 'Draft · save progress first and review later' },
+            { value: 'passport', label: 'Passport · finish now when public publishing is allowed' },
+            { value: 'back', label: 'Back' },
+        ]);
+        if (!destinationChoice || destinationChoice === 'back') {
+            return null;
+        }
+        renderInteractiveScreen('Choose Visibility', {
+            subtitle: displayName ? `Welcome, ${displayName}` : targetModel.model,
+            sections: [
+                {
+                    title: 'Visibility',
+                    lines: [
+                        shellListLine('Private keeps the registration as a draft for your review.'),
+                        shellListLine('Public can publish a passport immediately when your account and scope allow it.'),
+                    ],
+                },
+                ...(accountLimits ? [{
+                        title: 'Account Limits',
+                        lines: [
+                            shellLine('Private passports', formatRemainingLimit(accountLimits.privatePassportsLimit, accountLimits.privatePassportsUsed, 'private passport')),
+                            shellLine('Drafts', formatRemainingLimit(accountLimits.draftLimit, accountLimits.draftsUsed, 'draft')),
+                        ],
+                    }] : []),
+            ],
+            footerLines: ['Choose private or public below.'],
+        });
+        const visibilityChoice = await promptSelection('Choose visibility', [
+            { value: 'private', label: 'Private · keep it draft-only for now' },
+            { value: 'public', label: 'Public · allow immediate publishing when possible' },
+            { value: 'back', label: 'Back' },
+        ]);
+        if (!visibilityChoice || visibilityChoice === 'back') {
+            return null;
+        }
+        return {
+            targetSelector: targetModel.discoveryHash,
+            targetModel,
+            scopeMode: scopeChoice === 'workspace' ? 'workspace' : 'solo',
+            destination: destinationChoice === 'passport' ? 'passport' : 'draft',
+            visibility: visibilityChoice === 'private' ? 'private' : 'public',
+            workspaceId: workspaceSelection?.workspaceId ?? null,
+            projectId: workspaceSelection?.projectId ?? null,
+            workspaceLabel: workspaceSelection?.workspaceLabel ?? null,
+            projectLabel: workspaceSelection?.projectLabel ?? null,
+        };
+    };
+    const prepareInteractiveRegistrationScope = async (plan) => {
+        const currentState = service.getStateStore().readState();
+        const previousWorkspaceId = String(currentState.workspace_binding.workspaceId || '').trim() || null;
+        const previousProjectId = String(currentState.project_binding.projectId || '').trim() || null;
+        if (plan.scopeMode === 'solo') {
+            await service.bindWorkspaceProject(null, null);
+            return {
+                ok: true,
+                restore: async () => {
+                    if (previousWorkspaceId && previousProjectId) {
+                        await service.bindWorkspaceProject(previousWorkspaceId, previousProjectId);
+                    }
+                },
+            };
+        }
+        const scopeReady = Boolean(String(plan.workspaceId || '').trim() && String(plan.projectId || '').trim());
+        return {
+            ok: scopeReady,
+            restore: async () => { },
+        };
+    };
+    const runRegisterDetectedModel = async (plan) => {
+        const storedSessionRef = String(service.readSessionRef() || '').trim();
+        if (!storedSessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return false;
+        }
+        const preparedScope = await prepareInteractiveRegistrationScope(plan);
+        if (!preparedScope.ok) {
+            if (!process.exitCode || process.exitCode === 0) {
+                process.exitCode = 2;
+            }
+            return false;
+        }
+        try {
+            const result = await service.connectDetectedModel(plan.targetSelector, {
+                visibility: plan.visibility,
+                destination: plan.destination,
+            });
+            process.exitCode = 0;
+            const renderResult = async (status, done) => {
+                const websiteUrl = result.gaid
+                    ? buildPassportWebsiteUrl(result.gaid)
+                    : result.draftId
+                        ? buildDraftWebsiteUrl(result.draftId)
+                        : `${DEFAULT_BASE_URL}/connect`;
+                const websiteLabel = result.gaid
+                    ? 'Open published passport on Forkit.dev'
+                    : result.draftId
+                        ? 'Open draft on Forkit.dev'
+                        : 'Open Forkit Connect on Forkit.dev';
+                // Auto-open the website when registration succeeds — redirect user to their passport or draft
+                if (done && websiteUrl) {
+                    await openUrlWithFallback(websiteUrl, `[forkit-connect] View on Forkit.dev: ${websiteUrl}`);
+                }
+                renderInteractiveScreen('Registration Result', {
+                    subtitle: result.model.model,
+                    sections: [
+                        {
+                            title: 'Your Choices',
+                            lines: [
+                                shellLine('Scope', plan.scopeMode),
+                                shellLine('Workspace', plan.workspaceLabel || 'solo'),
+                                shellLine('Project', plan.projectLabel || 'solo'),
+                                shellLine('Draft or passport', plan.destination),
+                                shellLine('Visibility', plan.visibility),
+                            ],
+                        },
+                        {
+                            title: 'Result',
+                            lines: [
+                                shellLine('Passport registered successfully', done ? 'yes' : 'no'),
+                                shellLine('Status', status),
+                                ...(result.draftId ? [shellLine('Draft ID', result.draftId)] : []),
+                                ...(result.gaid ? [shellLine('Passport GAID', result.gaid)] : []),
+                                shellLine('Website link', websiteUrl),
+                            ],
+                        },
+                    ],
+                    footerLines: ['Open the Forkit.dev page or go back.'],
+                });
+                const selected = await promptSelection('Registration result', [
+                    { value: 'open', label: websiteLabel },
+                    { value: 'back', label: 'Back' },
+                ]);
+                if (selected === 'open') {
+                    await openUrlWithFallback(websiteUrl, '[forkit-connect] Open this URL manually:');
+                }
+            };
+            if (result.action === 'already_bound') {
+                await renderResult('already connected to a passport', true);
+                return true;
+            }
+            if (result.action === 'already_pending') {
+                await renderResult('already has a pending draft', true);
+                return true;
+            }
+            if (result.action === 'passport_registered') {
+                await renderResult('passport published', true);
+                return true;
+            }
+            if (result.action === 'draft_created') {
+                await renderResult('draft created', true);
+                return true;
+            }
+            await renderResult('draft queued locally', false);
+            return true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'connect_failed';
+            if (message === 'MODEL_NOT_FOUND') {
+                console.error('Model not found in local detected models. Run forkit-connect scan first.');
+            }
+            else if (message === 'MODEL_SELECTION_AMBIGUOUS') {
+                console.error('Model selection is ambiguous. Use the full discoveryHash.');
+            }
+            else if (message === 'WORKSPACE_PROJECT_BINDING_REQUIRED') {
+                console.error('No governed workspace/project scope is linked yet. Choose a workspace/project first, then try again.');
+            }
+            else if (message === 'DRAFT_CREATION_NOT_ALLOWED_BY_BINDING') {
+                console.error('Draft creation is not active for this binding yet. Complete Connect approval or update consent on Forkit.dev first.');
+            }
+            else if (message === 'DRAFT_ALREADY_EXISTS') {
+                console.error('A backend draft already exists for this model. No duplicate draft created.');
+            }
+            else if (message === 'SIMILAR_PASSPORT_EXISTS') {
+                console.error('A similar or existing passport already exists in your Forkit.dev account. Open inbox and review the connected/passport match before creating a new draft.');
+            }
+            else if (message.startsWith('DRAFT_CREATE_FAILED:')) {
+                console.error(`[forkit-connect] Draft creation failed (${message.split(':')[1]}).`);
+            }
+            else {
+                console.error(message);
+            }
+            process.exitCode = 2;
+            return false;
+        }
+        finally {
+            await preparedScope.restore();
+        }
+    };
+    const buildInteractiveRegisterCandidates = () => {
+        const inbox = service.buildSmartRegistrationInbox();
+        const candidates = new Map();
+        const groups = ['needs_confirmation', 'ready_to_connect'];
+        const state = service.getStateStore().readState();
+        for (const group of groups) {
+            for (const item of inbox.groups[group]) {
+                if (item.recommended_action !== 'create_passport_draft') {
+                    continue;
+                }
+                const model = item.item_type === 'model'
+                    ? state.detected_models.find((entry) => entry.discoveryHash === extractInboxItemSelector(item))
+                        ?? resolveSingleDetectedModelByName(service, item.display_name)
+                    : item.item_type === 'runtime'
+                        ? resolveSingleDetectedModelByName(service, String(item.details_received_automatically.connectable_model_name || '').trim())
+                        : null;
+                if (!model) {
+                    continue;
+                }
+                const key = normalizeModelSelector(model.discoveryHash);
+                if (candidates.has(key)) {
+                    continue;
+                }
+                candidates.set(key, {
+                    value: model.discoveryHash,
+                    label: `${model.model} · ${group === 'needs_confirmation' ? 'Needs confirmation' : 'Ready to connect'}`,
+                    preview: formatModelFriendlySummary(model),
+                });
+            }
+        }
+        return [...candidates.values()].sort((left, right) => left.label.localeCompare(right.label));
+    };
+    const runInteractiveRegisterMenu = async () => {
+        await runInteractiveAutoRefresh();
+        const candidates = buildInteractiveRegisterCandidates();
+        if (candidates.length === 0) {
+            renderInteractiveScreen('Register Models', {
+                subtitle: 'No ready local models are available yet',
+                sections: [
+                    {
+                        title: 'Next Steps',
+                        lines: [
+                            shellListLine('Run discovery to detect local runtimes and models.'),
+                            shellListLine('Review inbox items that still need confirmation.'),
+                        ],
+                    },
+                ],
+            });
+            return;
+        }
+        renderInteractiveScreen('Register Models', {
+            subtitle: 'Choose a ready local model to register',
+            sections: [
+                {
+                    title: 'Candidates',
+                    lines: candidates.slice(0, 8).map((candidate) => shellListLine(`${candidate.label} | ${candidate.preview}`)),
+                },
+            ],
+            footerLines: ['Select a model below.'],
+        });
+        const selected = await promptSelection('Choose a model to register', [
+            ...candidates,
+            { value: '__all__', label: 'Register every ready model' },
+            { value: '__back__', label: 'Back to main menu' },
+        ]);
+        if (!selected || selected === '__back__') {
+            return;
+        }
+        if (selected === '__all__') {
+            for (const candidate of candidates) {
+                const plan = await chooseInteractiveRegistrationScope(candidate.value);
+                if (!plan) {
+                    continue;
+                }
+                await runRegisterDetectedModel(plan);
+            }
+            return;
+        }
+        const plan = await chooseInteractiveRegistrationScope(selected);
+        if (!plan) {
+            return;
+        }
+        await runRegisterDetectedModel(plan);
+    };
+    const formatInboxGroupName = (group) => {
+        switch (group) {
+            case 'ready_to_connect':
+                return 'Ready';
+            case 'needs_confirmation':
+                return 'Needs confirmation';
+            case 'connected':
+                return 'Connected';
+            case 'ignored':
+                return 'Ignored';
+            default:
+                return group.replaceAll('_', ' ');
+        }
+    };
+    const extractInboxItemSelector = (item) => (item.item_id.split(':').slice(1).join(':'));
+    const getInboxDetailText = (item, key) => String(item.details_received_automatically[key] || '').trim();
+    const printInteractiveInboxItemDetails = (item, group) => {
+        console.log(`[forkit-connect] Inbox item: ${item.display_name}`);
+        console.log(`- group=${formatInboxGroupName(group)}`);
+        console.log(`- type=${item.item_type}`);
+        console.log(`- source=${item.detected_source}`);
+        console.log(`- confidence=${item.confidence}`);
+        console.log(`- next=${formatSmartInboxActionLabel(item)}`);
+        if (item.workspaceId) {
+            console.log(`- workspace=${item.workspaceId}`);
+        }
+        if (item.projectId) {
+            console.log(`- project=${item.projectId}`);
+        }
+        if (item.passport_gaid) {
+            console.log(`- passport_gaid=${item.passport_gaid}`);
+        }
+        if (item.matched_passport_gaid && item.matched_passport_gaid !== item.passport_gaid) {
+            console.log(`- matched_passport=${item.matched_passport_gaid}`);
+        }
+        const detailKeys = [
+            'verification_summary',
+            'limitations_summary',
+            'scope_suggestion',
+            'scope_mismatch_reason',
+            'connectable_model_name',
+            'linked_model_candidate',
+            'public_state',
+            'last_seen',
+        ];
+        for (const key of detailKeys) {
+            const value = getInboxDetailText(item, key);
+            if (value) {
+                console.log(`- ${key}=${value}`);
+            }
+        }
+    };
+    const runInteractiveOpenOnForkit = async (item) => {
+        const gaid = item.passport_gaid || item.matched_passport_gaid;
+        if (gaid) {
+            console.log(`[forkit-connect] Review this item on Forkit.dev. Passport GAID: ${gaid}`);
+        }
+        else {
+            console.log('[forkit-connect] Review this item on Forkit.dev.');
+        }
+        await openUrlWithFallback(`${DEFAULT_BASE_URL}/connect`, '[forkit-connect] Open this URL manually:');
+    };
+    const runInteractiveIgnoreInboxItem = (item) => {
+        const selector = extractInboxItemSelector(item);
+        if (item.item_type === 'model') {
+            const state = service.getStateStore().readState();
+            const model = state.detected_models.find((entry) => entry.discoveryHash === selector);
+            if (!model) {
+                console.error('Model not found anymore. Run forkit-connect scan again.');
+                process.exitCode = 2;
+                return;
+            }
+            const ignored = service.markModelIgnored(model.model, model.digest);
+            if (!ignored) {
+                console.error('Ignore failed.');
+                process.exitCode = 2;
+                return;
+            }
+            console.log(`[forkit-connect] Ignored model: ${model.model} (${model.digest})`);
+            process.exitCode = 0;
+            return;
+        }
+        if (item.item_type === 'runtime') {
+            service.markRuntimeIgnored(selector);
+            console.log(`[forkit-connect] Ignored runtime: ${item.display_name}`);
+            process.exitCode = 0;
+            return;
+        }
+        console.log('[forkit-connect] Ignore is not available for this inbox item type from the public menu yet.');
+    };
+    const runInteractiveDeferInboxItem = (item) => {
+        const selector = extractInboxItemSelector(item);
+        if (item.item_type === 'model') {
+            service.deferDetectedModel(selector);
+            console.log(`[forkit-connect] Deferred model review for: ${item.display_name}`);
+            process.exitCode = 0;
+            return;
+        }
+        if (item.item_type === 'runtime') {
+            service.deferRuntimeSuggestion(selector);
+            console.log(`[forkit-connect] Deferred runtime review for: ${item.display_name}`);
+            process.exitCode = 0;
+            return;
+        }
+        console.log('[forkit-connect] Defer is not available for this inbox item type from the public menu yet.');
+    };
+    const runInteractiveInboxAction = async (item, group) => {
+        if (group === 'connected' && (item.item_type === 'model' || item.item_type === 'runtime')) {
+            renderInteractiveScreen('Connected Model Activity', {
+                subtitle: item.display_name,
+                sections: buildConnectedItemActivitySections(service, item),
+                footerLines: ['Forkit Connect keeps collecting local activity logs while background sync is running.'],
+            });
+            await promptSelection('Connected activity', [{ value: 'back', label: 'Back to inbox' }]);
+            return;
+        }
+        const selected = await promptSelection('Choose an action for this inbox item', [
+            ...item.allowed_actions.map((action) => ({
+                value: action,
+                label: formatSmartInboxActionValue(action, item.item_type, String(item.details_received_automatically.connectable_model_name || '').trim()),
+            })),
+            { value: 'back', label: 'Back to inbox' },
+        ]);
+        if (!selected || selected === 'back') {
+            return;
+        }
+        if (selected === 'create_passport_draft') {
+            const targetModelName = item.item_type === 'runtime'
+                ? String(item.details_received_automatically.connectable_model_name || '').trim()
+                : item.item_type === 'model'
+                    ? item.display_name
+                    : '';
+            if (!targetModelName) {
+                console.log('[forkit-connect] Direct registration from this inbox item type is not exposed in the public menu yet.');
+                if (item.item_type === 'agent') {
+                    console.log('[forkit-connect] Use forkit-connect agent review for now.');
+                }
+                return;
+            }
+            const targetModel = resolveSingleDetectedModelByName(service, targetModelName);
+            const plan = await chooseInteractiveRegistrationScope(targetModel?.discoveryHash || targetModelName);
+            if (!plan) {
+                return;
+            }
+            await runRegisterDetectedModel(plan);
+            return;
+        }
+        if (selected === 'reconnect_account') {
+            await runPublicLogin();
+            return;
+        }
+        if (selected === 'ignore') {
+            runInteractiveIgnoreInboxItem(item);
+            return;
+        }
+        if (selected === 'defer') {
+            runInteractiveDeferInboxItem(item);
+            return;
+        }
+        if (selected === 'open_on_forkit' || selected === 'connect_existing_passport') {
+            await runInteractiveOpenOnForkit(item);
+            return;
+        }
+        if (selected === 'link_agent_to_model') {
+            console.log('[forkit-connect] Agent-to-model linking is not yet exposed as a guided public CLI flow.');
+            console.log('[forkit-connect] Use forkit-connect agent review for now.');
+            return;
+        }
+        if (selected === 'confirm_version_candidate') {
+            printJson(service.reviewModelEvolution());
+            return;
+        }
+    };
+    const runInteractiveInbox = async () => {
+        await runInteractiveAutoRefresh();
+        const groupOrder = ['needs_confirmation', 'ready_to_connect', 'connected', 'ignored'];
+        while (true) {
+            const inbox = service.buildSmartRegistrationInbox();
+            const entries = groupOrder.flatMap((group) => inbox.groups[group].map((item) => ({ group, item })));
+            if (entries.length === 0) {
+                renderInteractiveScreen('Smart Registration Inbox', {
+                    subtitle: 'No inbox items are available right now',
+                    sections: [
+                        {
+                            title: 'Next Steps',
+                            lines: [shellListLine('Run discovery first to refresh local runtimes, models, and agents.')],
+                        },
+                    ],
+                });
+                return;
+            }
+            renderInteractiveScreen('Smart Registration Inbox', {
+                subtitle: `Generated at ${inbox.summary.generated_at}`,
+                sections: buildInteractiveInboxSections(inbox),
+                footerLines: ['Choose an inbox item below.'],
+            });
+            const selected = await promptSelection('Choose an inbox item', [
+                ...entries.map(({ group, item }) => ({
+                    value: item.item_id,
+                    label: `[${formatInboxGroupName(group)}] ${item.display_name} — ${formatSmartInboxActionLabel(item)}`,
+                })),
+                { value: '__back__', label: 'Back to main menu' },
+            ]);
+            if (!selected || selected === '__back__') {
+                return;
+            }
+            const match = entries.find(({ item }) => item.item_id === selected);
+            if (!match) {
+                renderInteractiveScreen('Smart Registration Inbox', {
+                    subtitle: 'The selected item disappeared during refresh',
+                    sections: [{ title: 'Info', lines: [shellListLine('Refreshing inbox list now.')] }],
+                });
+                continue;
+            }
+            if (match.group === 'connected' && (match.item.item_type === 'model' || match.item.item_type === 'runtime')) {
+                await runInteractiveInboxAction(match.item, match.group);
+                continue;
+            }
+            renderInteractiveScreen('Inbox Item', {
+                subtitle: match.item.display_name,
+                sections: buildInteractiveInboxItemSections(match.item, match.group),
+                footerLines: ['Choose what to do with this item below.'],
+            });
+            await runInteractiveInboxAction(match.item, match.group);
+        }
+    };
+    const runInteractiveStart = async () => {
+        while (true) {
+            process.exitCode = 0;
+            await runInteractiveAutoRefresh();
+            const sessionState = await checkBackendSessionState(service);
+            const authenticated = sessionState === 'authorized' || (sessionState === 'unavailable' && Boolean(service.readSessionRef()));
+            if (!authenticated) {
+                await renderInteractiveStatusScreen(sessionState);
+                const selected = await promptSelection('Choose an action', [
+                    { value: 'login', label: 'Login / connect this device' },
+                    { value: 'create-account', label: 'Create account on Forkit.dev' },
+                    { value: 'status', label: 'Status' },
+                    { value: 'changes', label: 'View all collected changes' },
+                    { value: 'help', label: 'Help' },
+                    { value: 'exit', label: 'Exit' },
+                ]);
+                if (!selected || selected === 'exit') {
+                    return;
+                }
+                if (selected === 'login') {
+                    const approved = await runPublicLogin();
+                    if (approved) {
+                        continue;
+                    }
+                    return;
+                }
+                if (selected === 'create-account') {
+                    console.log('[forkit-connect] Open Forkit.dev to create or sign into your account:');
+                    await openUrlWithFallback(buildCreateAccountUrl(), '[forkit-connect] Open this URL manually:');
+                    continue;
+                }
+                if (selected === 'status') {
+                    await renderInteractiveStatusScreen(sessionState);
+                    await promptSelection('Status', [{ value: 'back', label: 'Back to main menu' }]);
+                    continue;
+                }
+                if (selected === 'changes') {
+                    renderInteractiveChangesScreen();
+                    await promptSelection('Collected changes', [{ value: 'back', label: 'Back to main menu' }]);
+                    continue;
+                }
+                showUsage();
+                continue;
+            }
+            const daemonHealth = (0, daemon_1.getDaemonHealth)(service);
+            if (!daemonHealth.running) {
+                await runPublicDaemonStart();
+                process.exitCode = 0;
+            }
+            await renderInteractiveStatusScreen(sessionState);
+            const selected = await promptSelection('Choose an action', [
+                { value: 'status', label: 'Status' },
+                { value: 'changes', label: 'View all collected changes' },
+                { value: 'inbox', label: 'Inbox' },
+                { value: 'register', label: 'Register ready model' },
+                { value: 'start-sync', label: 'Restart background sync' },
+                { value: 'update', label: 'Update' },
+                { value: 'help', label: 'Help' },
+                { value: 'logout', label: 'Log out' },
+                { value: 'exit', label: 'Exit' },
+            ]);
+            if (!selected || selected === 'exit') {
+                return;
+            }
+            if (selected === 'status') {
+                await renderInteractiveStatusScreen(sessionState);
+                await promptSelection('Status', [{ value: 'back', label: 'Back to main menu' }]);
+                continue;
+            }
+            if (selected === 'changes') {
+                renderInteractiveChangesScreen();
+                await promptSelection('Collected changes', [{ value: 'back', label: 'Back to main menu' }]);
+                continue;
+            }
+            if (selected === 'inbox') {
+                await runInteractiveInbox();
+                continue;
+            }
+            if (selected === 'register') {
+                await runInteractiveRegisterMenu();
+                continue;
+            }
+            if (selected === 'start-sync') {
+                await runPublicDaemonStart();
+                continue;
+            }
+            if (selected === 'update') {
+                await runPublicUpdateCheck();
+                continue;
+            }
+            if (selected === 'help') {
+                showUsage();
+                continue;
+            }
+            if (selected === 'logout') {
+                runPublicLogout();
+            }
+        }
+    };
+    const runPublicDaemonStart = async () => {
+        const sessionState = await checkBackendSessionState(service);
+        if (sessionState === 'missing' || sessionState === 'expired') {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        if (sessionState === 'unavailable') {
+            console.error('Forkit.dev workspace access is unavailable right now. Retry in a moment.');
+            process.exitCode = 2;
+            return;
+        }
+        try {
+            await service.refreshEffectiveBinding();
+        }
+        catch {
+            // Continue with locally stored binding when backend refresh is unavailable.
+        }
+        const operatingMode = resolveOperatingMode(service);
+        const stateBeforeStart = service.getStateStore().readState();
+        const boundWorkspaceId = String(stateBeforeStart.workspace_binding.workspaceId || '').trim();
+        const boundProjectId = String(stateBeforeStart.project_binding.projectId || '').trim();
+        if (operatingMode.mode === 'solo' && (!boundWorkspaceId || !boundProjectId)) {
+            console.log('[forkit-connect] Solo mode active. Personal passport operations remain available without workspace/project scope until you move this device into governed operations.');
+        }
+        if (operatingMode.mode === 'governed' && (!boundWorkspaceId || !boundProjectId)) {
+            console.log('[forkit-connect] Background sync is starting without a selected workspace/project scope.');
+            console.log('[forkit-connect] Choose a workspace only when you register a new model or change scope later.');
+        }
+        const intervalOverride = intervalSecondsArg !== null ? Number(intervalSecondsArg) : undefined;
+        const hasIntervalOverride = typeof intervalOverride === 'number' && Number.isFinite(intervalOverride);
+        const foreground = hasFlag('--foreground');
+        if (foreground) {
+            console.log('Starting daemon in foreground mode. Press Ctrl+C to stop.');
+            if (hasIntervalOverride) {
+                await (0, daemon_1.runDaemonLoopForeground)(service, { intervalSeconds: intervalOverride });
+            }
+            else {
+                await (0, daemon_1.runDaemonLoopForeground)(service);
+            }
+            return;
+        }
+        const launch = await (0, daemon_1.startDaemonBackground)(service, __filename, hasIntervalOverride ? intervalOverride : undefined);
+        if (!launch.pid || !launch.confirmed) {
+            console.error(launch.message || 'Failed to start daemon.');
+            process.exitCode = 2;
+            return;
+        }
+        const daemonStartedAt = new Date().toISOString();
+        console.log(launch.message || `Daemon started in background. pid=${launch.pid}`);
+        console.log(`[forkit-connect] Background sync started at ${daemonStartedAt} — recorded locally.`);
+        console.log('[forkit-connect] Terminal close will not stop background sync. Use forkit-connect stop or log out when you want to disconnect it.');
+        console.log('[forkit-connect] Any model activity detected while sync is running will be captured in evidence logs (forkit-connect changes).');
+        const discovery = await service.runDiscoveryCycle();
+        console.log(`[forkit-connect] Discovery complete. models=${discovery.models.length} runtimes=${discovery.runtimes.length} new=${discovery.newModels} ready_queue=${discovery.queue.queued}`);
+        if (!discovery.ok) {
+            process.exitCode = 2;
+        }
+    };
+    const runPublicDaemonStop = async () => {
+        const stop = await (0, daemon_1.stopDaemonBackground)(service);
+        const daemonStoppedAt = new Date().toISOString();
+        console.log(stop.message);
+        if (stop.stopped) {
+            console.log(`[forkit-connect] Background sync stopped at ${daemonStoppedAt} — recorded locally.`);
+            console.log('[forkit-connect] Any model version changes or activity detected before this point are preserved in evidence logs (forkit-connect changes).');
+        }
+        else {
+            process.exitCode = 2;
+        }
+    };
+    const runPublicSync = async () => {
+        const queue = await service.processQueue();
+        const c2 = await service.flushC2LifecycleEvents({ suppressErrors: true });
+        printJson({
+            drafts: queue,
+            lifecycle: {
+                attempted: c2.attempted,
+                succeeded: c2.succeeded,
+                failed: c2.failed,
+                pending: c2.pending,
+                synced: c2.synced,
+                last_sync_at: c2.lastSyncAt,
+                last_sync_error: c2.lastSyncError,
+            },
+        });
+    };
+    const runWorkspaceList = async () => {
+        const sessionRefValue = String(service.readSessionRef() || '').trim();
+        if (!sessionRefValue) {
+            throw new Error('NOT_AUTHENTICATED');
+        }
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: sessionRefValue,
+        });
+        const result = await api.getProfileAccess();
+        if (!result.ok || !isProfileAccessResponse(result.body)) {
+            throw new Error(`WORKSPACE_LIST_FAILED:${result.status}`);
+        }
+        const payload = result.body;
+        const rawWorkspaces = Array.isArray(payload.workspaces) ? payload.workspaces : [];
+        const seenWorkspaceIds = new Set();
+        const workspaces = rawWorkspaces.filter((workspace) => {
+            const id = String(workspace.id || '').trim();
+            if (!id)
+                return true;
+            if (seenWorkspaceIds.has(id))
+                return false;
+            seenWorkspaceIds.add(id);
+            return true;
+        });
+        return { payload, workspaces };
+    };
+    const ensureGovernedMode = () => {
+        const operatingMode = resolveOperatingMode(service);
+        if (operatingMode.mode !== 'governed') {
+            console.error('Workspace/project governance is not required on this account. Solo mode is active.');
+            process.exitCode = 2;
+            return null;
+        }
+        return operatingMode;
+    };
+    const buildWorkspaceApi = () => {
+        const sessionRefValue = String(service.readSessionRef() || '').trim();
+        return new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: sessionRefValue,
+        });
+    };
+    let cachedCliAccountLimits = null;
+    let cachedCliAccountLimitsAt = 0;
+    const loadCliAccountLimits = async (options) => {
+        const displayName = getSessionDisplayName(service.readSessionRef());
+        const now = Date.now();
+        if (!options?.force && cachedCliAccountLimits && now - cachedCliAccountLimitsAt < 15000) {
+            return cachedCliAccountLimits;
+        }
+        const sessionRefValue = String(service.readSessionRef() || '').trim();
+        const fallbackPlanKey = resolveCliPlanKey(service.getServiceEntitlements().tier);
+        const fallbackPlan = CLI_FALLBACK_PLAN_LIMITS[fallbackPlanKey];
+        if (!sessionRefValue) {
+            const fallback = {
+                displayName,
+                planKey: fallbackPlanKey,
+                planName: getCliPlanName(fallbackPlanKey),
+                tier: service.getServiceEntitlements().tier ?? null,
+                draftsUsed: null,
+                draftLimit: fallbackPlan.draftPassports,
+                draftRemaining: null,
+                privatePassportsUsed: null,
+                privatePassportsLimit: fallbackPlan.privatePassports,
+                privatePassportsRemaining: null,
+                workspacesUsed: null,
+                workspaceLimit: fallbackPlan.maxWorkspaces,
+                workspaceRemaining: null,
+                projectsUsed: null,
+                projectLimit: fallbackPlan.maxProjects,
+                projectRemaining: null,
+                runtimeSignalsUsed: null,
+                runtimeSignalsLimit: fallbackPlan.runtimeSignalsPerMonth,
+                runtimeSignalsRemaining: null,
+            };
+            cachedCliAccountLimits = fallback;
+            cachedCliAccountLimitsAt = now;
+            return fallback;
+        }
+        const api = buildWorkspaceApi();
+        const [accessResult, summaryResult, draftsResult, passportsResult] = await Promise.all([
+            api.getProfileAccess().catch(() => null),
+            api.getProductSummary().catch(() => null),
+            api.getPassportDrafts().catch(() => null),
+            api.getPassportsMine(100).catch(() => null),
+        ]);
+        const accessPayload = accessResult?.ok && isProfileAccessResponse(accessResult.body) ? accessResult.body : null;
+        const summaryPayload = summaryResult?.ok && isProductSummaryResponse(summaryResult.body) ? summaryResult.body : null;
+        const workspaces = accessPayload?.workspaces && Array.isArray(accessPayload.workspaces) ? accessPayload.workspaces : [];
+        const drafts = draftsResult?.ok && isPassportDraftListResponse(draftsResult.body) && Array.isArray(draftsResult.body.drafts)
+            ? draftsResult.body.drafts
+            : [];
+        const passports = passportsResult?.ok ? readPassportList(passportsResult.body) : [];
+        const planKey = resolveCliPlanKey(summaryPayload?.planCapabilities?.planKey, summaryPayload?.package?.slug, summaryPayload?.tier, accessPayload?.summary?.tier, service.getServiceEntitlements().tier);
+        const fallback = CLI_FALLBACK_PLAN_LIMITS[planKey];
+        let projectsUsed = typeof summaryPayload?.usage?.projects === 'number' ? summaryPayload.usage.projects : null;
+        if (projectsUsed === null && workspaces.length > 0) {
+            try {
+                const projectResults = await Promise.all(workspaces.map(async (workspace) => {
+                    const workspaceId = String(workspace.id || '').trim();
+                    if (!workspaceId)
+                        return 0;
+                    const result = await api.getWorkspaceProjects(workspaceId);
+                    if (!result.ok || !isWorkspaceProjectsResponse(result.body))
+                        return 0;
+                    return Array.isArray(result.body.projects) ? result.body.projects.length : 0;
+                }));
+                projectsUsed = projectResults.reduce((total, count) => total + count, 0);
+            }
+            catch {
+                projectsUsed = null;
+            }
+        }
+        const privatePassportsUsed = typeof summaryPayload?.usage?.privatePassports === 'number'
+            ? summaryPayload.usage.privatePassports
+            : passports.some((passport) => Object.prototype.hasOwnProperty.call(passport, 'visibility'))
+                ? passports.filter((passport) => String(passport.visibility || '').trim().toLowerCase() === 'private').length
+                : null;
+        const draftsUsed = typeof summaryPayload?.usage?.drafts === 'number' ? summaryPayload.usage.drafts : drafts.length;
+        const workspacesUsed = workspaces.length;
+        const draftLimit = summaryPayload?.planCapabilities?.registration?.draftPassports
+            ?? summaryPayload?.entitlements?.draftPassports
+            ?? fallback.draftPassports;
+        const privatePassportsLimit = summaryPayload?.planCapabilities?.registration?.privatePassports
+            ?? summaryPayload?.entitlements?.privatePassports
+            ?? fallback.privatePassports;
+        const workspaceLimit = summaryPayload?.planCapabilities?.governance?.maxGovernedWorkspaces
+            ?? summaryPayload?.entitlements?.maxWorkspaces
+            ?? fallback.maxWorkspaces;
+        const projectLimit = summaryPayload?.planCapabilities?.governance?.maxGovernedProjects
+            ?? summaryPayload?.entitlements?.maxProjects
+            ?? fallback.maxProjects;
+        const runtimeSignalsLimit = summaryPayload?.planCapabilities?.runtimeSignals?.runtimeSignalsPerMonth
+            ?? fallback.runtimeSignalsPerMonth;
+        const runtimeSignalsUsed = typeof summaryPayload?.usage?.runtimeSignals === 'number'
+            ? summaryPayload.usage.runtimeSignals
+            : null;
+        const resolved = {
+            displayName,
+            planKey,
+            planName: getCliPlanName(planKey),
+            tier: String(summaryPayload?.tier || accessPayload?.summary?.tier || service.getServiceEntitlements().tier || '').trim() || null,
+            draftsUsed,
+            draftLimit,
+            draftRemaining: remainingFromLimit(draftLimit, draftsUsed),
+            privatePassportsUsed,
+            privatePassportsLimit,
+            privatePassportsRemaining: remainingFromLimit(privatePassportsLimit, privatePassportsUsed),
+            workspacesUsed,
+            workspaceLimit,
+            workspaceRemaining: remainingFromLimit(workspaceLimit, workspacesUsed),
+            projectsUsed,
+            projectLimit,
+            projectRemaining: remainingFromLimit(projectLimit, projectsUsed),
+            runtimeSignalsUsed,
+            runtimeSignalsLimit,
+            runtimeSignalsRemaining: remainingFromLimit(runtimeSignalsLimit, runtimeSignalsUsed),
+        };
+        cachedCliAccountLimits = resolved;
+        cachedCliAccountLimitsAt = now;
+        return resolved;
+    };
+    const createProjectInWorkspace = async (api, selectedWorkspaceId, options) => {
+        let nextProjectName = projectNameArg;
+        let nextProjectDescription = projectDescriptionArg;
+        if (!nextProjectName && options?.interactivePrompt !== false) {
+            nextProjectName = await promptText('Project name: ');
+            if (!nextProjectName) {
+                console.error('Project creation cancelled.');
+                process.exitCode = 2;
+                return null;
+            }
+            nextProjectDescription = await promptText('Project description (optional): ', { allowEmpty: true });
+        }
+        if (!nextProjectName) {
+            console.error('Missing project name. Use --project-name or run interactively.');
+            process.exitCode = 2;
+            return null;
+        }
+        const createResult = await api.createWorkspaceProject(selectedWorkspaceId, {
+            name: nextProjectName,
+            ...(nextProjectDescription ? { description: nextProjectDescription } : {}),
+        });
+        if (!createResult.ok || !isWorkspaceProjectCreateResponse(createResult.body)) {
+            console.error(`Project creation failed (${createResult.status}).`);
+            if (createResult.body) {
+                console.error(typeof createResult.body === 'string' ? createResult.body : JSON.stringify(createResult.body));
+            }
+            process.exitCode = 2;
+            return null;
+        }
+        await loadCliAccountLimits({ force: true }).catch(() => null);
+        return createResult.body.project ?? null;
+    };
+    const runWorkspaceCreate = async () => {
+        const operatingMode = ensureGovernedMode();
+        if (!operatingMode)
+            return;
+        const workspaceName = getArg('--name') || await promptText('Workspace name: ');
+        if (!workspaceName) {
+            console.error('Workspace creation cancelled.');
+            process.exitCode = 2;
+            return;
+        }
+        const workspaceDescription = descriptionArg ?? await promptText('Workspace description (optional): ', { allowEmpty: true });
+        const api = buildWorkspaceApi();
+        const createWorkspaceResult = await api.createWorkspace({
+            name: workspaceName,
+            ...(workspaceDescription ? { description: workspaceDescription } : {}),
+        });
+        if (!createWorkspaceResult.ok || !isWorkspaceCreateResponse(createWorkspaceResult.body)) {
+            console.error(`Workspace creation failed (${createWorkspaceResult.status}).`);
+            if (createWorkspaceResult.body) {
+                console.error(typeof createWorkspaceResult.body === 'string' ? createWorkspaceResult.body : JSON.stringify(createWorkspaceResult.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        const workspace = createWorkspaceResult.body.workspace && typeof createWorkspaceResult.body.workspace === 'object'
+            ? createWorkspaceResult.body.workspace
+            : null;
+        const createdWorkspaceId = String(workspace?.id || '').trim();
+        if (!createdWorkspaceId) {
+            console.error('Workspace creation returned no workspace id.');
+            process.exitCode = 2;
+            return;
+        }
+        await loadCliAccountLimits({ force: true }).catch(() => null);
+        let shouldCreateFirstProject = Boolean(projectNameArg);
+        if (!shouldCreateFirstProject) {
+            const selected = await promptSelection('Create first project now?', [
+                { value: 'create', label: 'Create project now' },
+                { value: 'skip', label: 'Skip for now' },
+            ]);
+            shouldCreateFirstProject = selected === 'create';
+        }
+        let createdProject = null;
+        if (shouldCreateFirstProject) {
+            createdProject = await createProjectInWorkspace(api, createdWorkspaceId, { interactivePrompt: true });
+            if (process.exitCode && process.exitCode !== 0) {
+                return;
+            }
+        }
+        let bindingResult = null;
+        if (createdProject?.id) {
+            bindingResult = await service.bindWorkspaceProject(createdWorkspaceId, String(createdProject.id));
+        }
+        printJson({
+            operating_mode: operatingMode.mode,
+            tier: operatingMode.tier,
+            workspace,
+            project: createdProject,
+            binding: bindingResult,
+        });
+    };
+    const runWorkspaceStatus = async () => {
+        const payload = await buildWorkspaceStatusPayload();
+        if (hasFlag('--json')) {
+            printJson(payload);
+            return;
+        }
+        console.log('[forkit-connect] Workspace status');
+        console.log(`- mode=${payload.operating_mode}`);
+        console.log(`- tier=${payload.tier || 'unknown'}`);
+        console.log(`- workspace=${payload.workspace_id || 'not selected'}`);
+        console.log(`- project=${payload.project_id || 'not selected'}`);
+        console.log(`- session=${payload.session_state}`);
+        console.log(`- binding_state=${payload.binding_state}`);
+        console.log(`- daemon=${payload.daemon_status}`);
+        console.log(`- ready_to_connect=${payload.ready_to_connect_count}`);
+        console.log(`- needs_confirmation=${payload.needs_confirmation_count}`);
+        console.log(`- connected=${payload.connected_count}`);
+        if (payload.lifecycle_note) {
+            console.log(`- note=${payload.lifecycle_note}`);
+        }
+    };
+    const runWorkspaceSelect = async () => {
+        const operatingMode = ensureGovernedMode();
+        if (!operatingMode)
+            return;
+        const { workspaces } = await runWorkspaceList();
+        if (workspaces.length === 0) {
+            console.log('No accessible workspaces returned by Forkit.dev.');
+            await runWorkspaceCreate();
+            return;
+        }
+        let selectedWorkspaceId = workspaceId;
+        if (!selectedWorkspaceId) {
+            selectedWorkspaceId = await promptSelection('Accessible workspaces', [
+                ...workspaces.map((workspace) => ({
+                    value: String(workspace.id || ''),
+                    label: `${workspace.name || 'Unnamed workspace'} (${String(workspace.role || 'unknown')})`,
+                })),
+                { value: '__create_workspace__', label: 'Create new workspace' },
+            ]);
+            if (!selectedWorkspaceId) {
+                console.error('Workspace selection cancelled.');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (selectedWorkspaceId === '__create_workspace__') {
+            await runWorkspaceCreate();
+            return;
+        }
+        const api = buildWorkspaceApi();
+        const projectsResult = await api.getWorkspaceProjects(selectedWorkspaceId);
+        if (!projectsResult.ok || !isWorkspaceProjectsResponse(projectsResult.body)) {
+            console.error(`Project listing failed (${projectsResult.status}).`);
+            process.exitCode = 2;
+            return;
+        }
+        const projects = Array.isArray(projectsResult.body.projects) ? projectsResult.body.projects : [];
+        if (projects.length === 0) {
+            console.log('No projects found in this workspace.');
+            const createdProject = await createProjectInWorkspace(api, selectedWorkspaceId, { interactivePrompt: true });
+            if (!createdProject?.id) {
+                return;
+            }
+            const bindingResult = await service.bindWorkspaceProject(selectedWorkspaceId, String(createdProject.id));
+            printJson({
+                operating_mode: operatingMode.mode,
+                tier: operatingMode.tier,
+                created_project: createdProject,
+                binding: bindingResult,
+            });
+            return;
+        }
+        let selectedProjectValue = projectId;
+        if (!selectedProjectValue) {
+            selectedProjectValue = await promptSelection('Projects in selected workspace', [
+                ...projects.map((project) => ({
+                    value: String(project.id || ''),
+                    label: project.name || 'Unnamed project',
+                })),
+                { value: '__create_project__', label: 'Create new project' },
+            ]);
+            if (!selectedProjectValue) {
+                console.error('Project selection cancelled.');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (selectedProjectValue === '__create_project__') {
+            const createdProject = await createProjectInWorkspace(api, selectedWorkspaceId, { interactivePrompt: true });
+            if (!createdProject?.id) {
+                return;
+            }
+            const bindingResult = await service.bindWorkspaceProject(selectedWorkspaceId, String(createdProject.id));
+            printJson({
+                operating_mode: operatingMode.mode,
+                tier: operatingMode.tier,
+                created_project: createdProject,
+                binding: bindingResult,
+            });
+            return;
+        }
+        const bindingResult = await service.bindWorkspaceProject(selectedWorkspaceId, selectedProjectValue);
+        printJson(bindingResult);
+    };
+    const runPublicRegister = async () => {
+        const state = service.getStateStore().readState();
+        const storedSessionRef = String(service.readSessionRef() || '').trim();
+        if (!storedSessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        try {
+            await service.refreshEffectiveBinding();
+        }
+        catch {
+            // Use local binding when backend refresh is temporarily unavailable.
+        }
+        const operatingMode = resolveOperatingMode(service);
+        let currentState = service.getStateStore().readState();
+        let boundWorkspaceId = String(currentState.workspace_binding.workspaceId || '').trim();
+        let boundProjectId = String(currentState.project_binding.projectId || '').trim();
+        if (operatingMode.mode === 'governed' && (!boundWorkspaceId || !boundProjectId)) {
+            console.log('[forkit-connect] Governed mode requires a workspace/project selection before registration.');
+            await runWorkspaceSelect();
+            if (process.exitCode && process.exitCode !== 0) {
+                return;
+            }
+            currentState = service.getStateStore().readState();
+            boundWorkspaceId = String(currentState.workspace_binding.workspaceId || '').trim();
+            boundProjectId = String(currentState.project_binding.projectId || '').trim();
+            if (!boundWorkspaceId || !boundProjectId) {
+                console.error('No workspace/project selected. Run forkit-connect workspace select first.');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        const normalizeRegisterErrorMessage = (raw) => {
+            if (raw === 'MODEL_NOT_FOUND')
+                return 'Model not found in local detected models. Run forkit-connect scan first.';
+            if (raw === 'MODEL_SELECTION_AMBIGUOUS')
+                return 'Model selection is ambiguous. Use a full discoveryHash.';
+            if (raw === 'DRAFT_ALREADY_EXISTS')
+                return 'A backend draft already exists for this model. No duplicate draft created.';
+            if (raw === 'SIMILAR_PASSPORT_EXISTS')
+                return 'A similar or existing passport already exists in your Forkit.dev account. Review existing records before creating a new draft.';
+            if (raw === 'WORKSPACE_PROJECT_BINDING_REQUIRED')
+                return 'No governed workspace/project scope is linked yet. Select or create scope first.';
+            if (raw === 'DRAFT_CREATION_NOT_ALLOWED_BY_BINDING')
+                return 'Draft creation is not active for this binding yet. Complete Connect approval or update consent on Forkit.dev first.';
+            return raw;
+        };
+        const runRegisterOne = async (targetModelName) => {
+            try {
+                const result = await service.connectDetectedModel(targetModelName);
+                return {
+                    ok: true,
+                    model: result.model.model,
+                    draftId: result.draftId ?? null,
+                    gaid: result.gaid ?? null,
+                    message: result.action,
+                };
+            }
+            catch (error) {
+                const rawMessage = error instanceof Error ? error.message : 'register_failed';
+                return {
+                    ok: false,
+                    model: targetModelName,
+                    message: normalizeRegisterErrorMessage(rawMessage),
+                };
+            }
+        };
+        if (hasFlag('--all-ready')) {
+            const inbox = service.buildSmartRegistrationInbox();
+            const readyModels = inbox.groups.ready_to_connect
+                .filter((item) => item.item_type === 'model' && item.recommended_action === 'create_passport_draft')
+                .map((item) => item.display_name);
+            if (readyModels.length === 0) {
+                console.log('No ready local models need registration.');
+                return;
+            }
+            const results = [];
+            for (const item of readyModels) {
+                results.push(await runRegisterOne(item));
+            }
+            printJson({
+                attempted: readyModels.length,
+                results,
+            });
+            if (results.some((item) => !item.ok)) {
+                process.exitCode = 2;
+            }
+            return;
+        }
+        if (!modelName) {
+            const inbox = service.buildSmartRegistrationInbox();
+            const readyModels = inbox.groups.ready_to_connect
+                .filter((item) => item.item_type === 'model')
+                .map((item) => item.display_name);
+            printJson({
+                operating_mode: operatingMode.mode,
+                tier: operatingMode.tier,
+                workspace_id: boundWorkspaceId,
+                project_id: boundProjectId,
+                ready_models: readyModels,
+                next: readyModels.length
+                    ? 'Run forkit-connect register --model "<name>" or forkit-connect register --all-ready'
+                    : 'Run forkit-connect scan first or review forkit-connect inbox',
+            });
+            return;
+        }
+        const result = await runRegisterOne(modelName);
+        printJson(result);
+        if (!result.ok) {
+            process.exitCode = 2;
+        }
+    };
+    const runPublicIgnore = () => {
+        const positionalName = args[1] && !args[1].startsWith('-') ? args[1] : null;
+        const requestedName = positionalName || getArg('--ignore-model') || modelName;
+        const requestedDigest = getArg('--digest') || getArg('--ignore-digest');
+        if (!requestedName) {
+            console.error('Missing model name. Use forkit-connect ignore <modelName> [--digest <sha>].');
+            process.exitCode = 2;
+            return;
+        }
+        const resolvedModel = resolveSingleDetectedModelByName(service, requestedName, requestedDigest);
+        if (!resolvedModel) {
+            console.error('Model not found or ambiguous. Provide --digest when more than one detected model shares the same name.');
+            process.exitCode = 2;
+            return;
+        }
+        const ignored = service.markModelIgnored(resolvedModel.model, resolvedModel.digest);
+        if (!ignored) {
+            console.error('Ignore failed.');
+            process.exitCode = 2;
+            return;
+        }
+        printJson({
+            ignored: true,
+            model: resolvedModel.model,
+            digest: resolvedModel.digest,
+            runtime: resolvedModel.runtime,
+        });
+    };
+    if (command === 'init') {
+        runPublicConnectInit();
+        return;
+    }
+    if (command === 'status') {
+        await runPublicConnectStatus();
+        return;
+    }
+    if (command === 'changes') {
+        runPublicCollectedChanges();
+        return;
+    }
+    if (command === 'stop') {
+        await runPublicDaemonStop();
+        return;
+    }
+    if (command === 'inbox') {
+        runPublicConnectInbox();
+        return;
+    }
+    if (command === 'start') {
+        if (hasFlag('--foreground')) {
+            await runPublicDaemonStart();
+            return;
+        }
+        await runInteractiveStart();
+        return;
+    }
+    if (command === 'sync') {
+        await runPublicSync();
+        return;
+    }
+    if (command === 'workspace') {
+        const subcommand = args[1] || 'status';
+        try {
+            if (subcommand === 'list') {
+                const { workspaces } = await runWorkspaceList();
+                if (hasFlag('--json')) {
+                    printJson({ workspaces });
+                    return;
+                }
+                const accountLimits = await loadCliAccountLimits().catch(() => null);
+                console.log(`[forkit-connect] Workspaces: ${workspaces.length}`);
+                if (accountLimits) {
+                    console.log(`- welcome=${accountLimits.displayName || 'there'}`);
+                    console.log(`- plan=${accountLimits.planName}`);
+                    console.log(`- workspaces_left=${formatRemainingLimit(accountLimits.workspaceLimit, accountLimits.workspacesUsed, 'workspace')}`);
+                    console.log(`- projects_left=${formatRemainingLimit(accountLimits.projectLimit, accountLimits.projectsUsed, 'project')}`);
+                }
+                for (const workspace of workspaces) {
+                    console.log(formatWorkspaceAccessLine(workspace));
+                }
+                return;
+            }
+            if (subcommand === 'select') {
+                await runWorkspaceSelect();
+                return;
+            }
+            if (subcommand === 'create') {
+                await runWorkspaceCreate();
+                return;
+            }
+            if (subcommand === 'status') {
+                await runWorkspaceStatus();
+                return;
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'workspace_command_failed';
+            if (message === 'NOT_AUTHENTICATED') {
+                console.error('Not authenticated. Run forkit-connect login first.');
+            }
+            else if (message.startsWith('WORKSPACE_LIST_FAILED:')) {
+                console.error(`Workspace listing failed (${message.split(':')[1]}).`);
+            }
+            else {
+                console.error(message);
+            }
+            process.exitCode = 2;
+            return;
+        }
+        console.error('Usage: forkit-connect workspace <list|select|create|status>');
+        process.exitCode = 2;
+        return;
+    }
+    if (command === 'ignore') {
+        runPublicIgnore();
+        return;
+    }
+    if (command === 'review') {
+        const reviewScan = await service.scanRuntime();
+        const snapshot = service.buildReviewSnapshot(reviewScan.summary);
+        if (snapshot.total === 0) {
+            console.log('No review items found. Run `forkit-connect scan` first or ensure local runtimes are available.');
+            return;
+        }
+        printReviewSnapshot(snapshot);
+        return;
+    }
+    if (command === 'connect') {
+        const subcommand = args[1];
+        if (subcommand === 'start') {
+            runPublicConnectInit();
+            return;
+        }
+        if (subcommand === 'init') {
+            runPublicConnectInit();
+            return;
+        }
+        if (subcommand === 'status') {
+            await runPublicConnectStatus();
+            return;
+        }
+        if (subcommand === 'inbox') {
+            runPublicConnectInbox();
+            return;
+        }
+        if (subcommand === 'services') {
+            printJson(service.getConnectServices());
+            return;
+        }
+        if (subcommand === 'permissions') {
+            printJson(service.getConnectPermissions());
+            return;
+        }
+        if (subcommand === 'handoff') {
+            printJson(service.buildConnectHandoff());
+            return;
+        }
+        if (subcommand === 'evolution') {
+            if (args[2] !== 'review') {
+                console.error('Usage: forkit-connect connect evolution review');
+                process.exitCode = 2;
+                return;
+            }
+            printJson(service.reviewModelEvolution());
+            return;
+        }
+        if (subcommand === 'runtime') {
+            if (args[2] === 'review') {
+                printRuntimeReview(service.getRuntimePassportReview());
+                return;
+            }
+            if (args[2] === 'status') {
+                printRuntimeStatus(service.getRuntimePassportStatus());
+                return;
+            }
+            console.error('Usage: forkit-connect connect runtime <review|status>');
+            process.exitCode = 2;
+            return;
+        }
+        const selector = subcommand;
+        if (!selector) {
+            console.error('Missing required argument: <modelNameOrDiscoveryHash>');
+            process.exitCode = 2;
+            return;
+        }
+        try {
+            const result = await service.connectDetectedModel(selector);
+            if (result.action === 'already_bound') {
+                console.log('Model is already bound to a Passport.');
+                if (result.gaid) {
+                    console.log(`Passport GAID: ${result.gaid}`);
+                }
+                return;
+            }
+            if (result.action === 'already_pending') {
+                console.log('Model already has a pending Passport draft.');
+                if (result.draftId) {
+                    console.log(`Draft ID: ${result.draftId}`);
+                }
+                return;
+            }
+            if (result.action === 'draft_created') {
+                console.log('Passport draft created from detected model.');
+                console.log(`Model: ${result.model.model}`);
+                if (result.draftId) {
+                    console.log(`Draft ID: ${result.draftId}`);
+                }
+                if (result.gaid) {
+                    console.log(`Passport GAID: ${result.gaid}`);
+                }
+                return;
+            }
+            console.log('Passport draft queued locally from detected model.');
+            console.log(`Model: ${result.model.model}`);
+            console.log('Complete login later and run scan or queue processing to sync it.');
+            return;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'connect_failed';
+            if (message === 'MODEL_NOT_FOUND') {
+                console.error('Model not found in local detected models. Run forkit-connect scan first.');
+                process.exitCode = 2;
+                return;
+            }
+            if (message === 'MODEL_SELECTION_AMBIGUOUS') {
+                console.error('Model selection is ambiguous. Use the full discoveryHash.');
+                process.exitCode = 2;
+                return;
+            }
+            if (message === 'WORKSPACE_PROJECT_BINDING_REQUIRED') {
+                console.error('No governed workspace/project scope is linked yet. Personal mode stays available, but this action needs governed scope. After sign-in, run `forkit-connect workspaces`, `forkit-connect projects --workspace <id>`, and `forkit-connect bind --workspace <id> --project <id>` first.');
+                process.exitCode = 2;
+                return;
+            }
+            if (message === 'DRAFT_CREATION_NOT_ALLOWED_BY_BINDING') {
+                console.error('Draft creation is not active for this binding yet. Complete Connect approval or update consent on Forkit.dev before using governed scope from this device.');
+                process.exitCode = 2;
+                return;
+            }
+            if (message === 'DRAFT_ALREADY_EXISTS') {
+                console.error('A backend draft already exists for this model. No duplicate draft created.');
+                process.exitCode = 2;
+                return;
+            }
+            if (message === 'SIMILAR_PASSPORT_EXISTS') {
+                console.error('A similar or existing passport already exists in your Forkit.dev account. Review inbox or existing passports before creating a new draft.');
+                process.exitCode = 2;
+                return;
+            }
+            if (message.startsWith('DRAFT_CREATE_FAILED:')) {
+                console.error(`[forkit-connect] Draft creation failed (${message.split(':')[1]}).`);
+                process.exitCode = 2;
+                return;
+            }
+            console.error(message);
+            process.exitCode = 2;
+            return;
+        }
+    }
+    if (command === 'c2') {
+        const subcommand = args[1];
+        if (subcommand === 'status') {
+            printC2Status(service.getC2Status());
+            return;
+        }
+        if (subcommand === 'set-key') {
+            const gaid = getArg('--heartbeat-gaid');
+            const apiKey = getArg('--heartbeat-key');
+            if (!gaid || !apiKey) {
+                console.error('[forkit-connect] --heartbeat-gaid and --heartbeat-key are required for c2 set-key');
+                process.exitCode = 1;
+                return;
+            }
+            const result = service.configureRuntimeSignalKey({ gaid, apiKey });
+            if (!result.stored) {
+                console.error('[forkit-connect] Failed to store runtime signal key. Verify the gaid matches a bound model and the key is 8–512 characters.');
+                process.exitCode = 2;
+                return;
+            }
+            console.log(JSON.stringify({
+                stored: result.stored,
+                gaid: result.gaid,
+                key_ref: result.keyRef,
+                backfilled_events: result.backfilled,
+            }, null, 2));
+            return;
+        }
+        if (subcommand === 'sync') {
+            const syncResult = await service.flushC2LifecycleEvents({
+                runtimeSignalApiKey: getArg('--heartbeat-key'),
+                gaid: getArg('--heartbeat-gaid'),
+                suppressErrors: true,
+            });
+            console.log(JSON.stringify({
+                attempted: syncResult.attempted,
+                succeeded: syncResult.succeeded,
+                failed: syncResult.failed,
+                pending: syncResult.pending,
+                synced: syncResult.synced,
+                last_sync_at: syncResult.lastSyncAt,
+                last_sync_error: syncResult.lastSyncError,
+            }, null, 2));
+            return;
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'train') {
+        const subcommand = args[1];
+        const buildSessionId = args[2];
+        if (subcommand === 'init') {
+            const trainName = getArg('--name');
+            const framework = getArg('--framework');
+            const task = getArg('--task');
+            const datasetRef = getArg('--dataset-ref');
+            if (!trainName || !framework || !task) {
+                console.error('Missing required arguments: --name <modelName> --framework <framework> --task <task>');
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const result = await service.initTrainingBuildSession({
+                    modelName: trainName,
+                    framework,
+                    task,
+                    datasetRef,
+                });
+                console.log(JSON.stringify({
+                    build_session_id: result.buildSession.build_session_id,
+                    model_name: result.buildSession.model_name,
+                    framework: result.buildSession.framework,
+                    task: result.buildSession.task,
+                    draft_action: result.draftAction,
+                    draft_id: result.draftId,
+                    passport_gaid: result.gaid,
+                    status: result.buildSession.status,
+                }, null, 2));
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'train_init_failed';
+                if (message === 'DRAFT_ALREADY_EXISTS') {
+                    console.error('A backend draft already exists for this training session metadata.');
+                }
+                else if (message.startsWith('DRAFT_CREATE_FAILED:')) {
+                    console.error(`[forkit-connect] Training draft creation failed (${message.split(':')[1]}).`);
+                }
+                else {
+                    console.error(message);
+                }
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'event') {
+            const eventType = getArg('--type');
+            if (!buildSessionId || !eventType) {
+                console.error('Missing required arguments: train event <build_session_id> --type <event_type>');
+                process.exitCode = 2;
+                return;
+            }
+            if (!TRAIN_EVENT_TYPES.includes(eventType)) {
+                console.error(`Unsupported event type. Use one of: ${TRAIN_EVENT_TYPES.join(', ')}`);
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const session = service.recordTrainingLifecycleEvent(buildSessionId, eventType);
+                console.log(JSON.stringify({
+                    build_session_id: session.build_session_id,
+                    status: session.status,
+                    latest_lifecycle_event: session.lifecycle_events.at(-1)?.event_type ?? null,
+                }, null, 2));
+                return;
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : 'train_event_failed');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'dataset') {
+            const datasetRef = getArg('--ref');
+            const changeType = getArg('--change');
+            if (!buildSessionId || !datasetRef || !changeType) {
+                console.error('Missing required arguments: train dataset <build_session_id> --ref <dataset_ref> --change <change_type>');
+                process.exitCode = 2;
+                return;
+            }
+            if (!TRAIN_DATASET_CHANGE_TYPES.includes(changeType)) {
+                console.error(`Unsupported dataset change type. Use one of: ${TRAIN_DATASET_CHANGE_TYPES.join(', ')}`);
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const session = service.recordTrainingDatasetChange(buildSessionId, datasetRef, changeType);
+                console.log(JSON.stringify({
+                    build_session_id: session.build_session_id,
+                    dataset_refs_count: session.dataset_refs.length,
+                    latest_dataset_change: session.dataset_refs.at(-1) ?? null,
+                }, null, 2));
+                return;
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : 'train_dataset_failed');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'metric') {
+            const metricName = getArg('--name');
+            const metricValue = getArg('--value');
+            if (!buildSessionId || !metricName || metricValue === null) {
+                console.error('Missing required arguments: train metric <build_session_id> --name <metric_name> --value <metric_value>');
+                process.exitCode = 2;
+                return;
+            }
+            const numericValue = Number(metricValue);
+            if (!Number.isFinite(numericValue)) {
+                console.error('Invalid --value. Use a finite number.');
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const session = service.recordTrainingMetric(buildSessionId, metricName, numericValue);
+                console.log(JSON.stringify({
+                    build_session_id: session.build_session_id,
+                    metrics_count: session.metrics.length,
+                    latest_metric: session.metrics.at(-1) ?? null,
+                }, null, 2));
+                return;
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : 'train_metric_failed');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'version') {
+            const versionName = getArg('--version');
+            const reason = getArg('--reason');
+            if (!buildSessionId || !versionName || !reason) {
+                console.error('Missing required arguments: train version <build_session_id> --version <version_name> --reason <reason>');
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const session = service.recordTrainingVersion(buildSessionId, versionName, reason);
+                console.log(JSON.stringify({
+                    build_session_id: session.build_session_id,
+                    versions_count: session.versions.length,
+                    latest_version: session.versions.at(-1) ?? null,
+                }, null, 2));
+                return;
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : 'train_version_failed');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'artifact') {
+            const artifactPath = getArg('--path');
+            if (!buildSessionId || !artifactPath) {
+                console.error('Missing required arguments: train artifact <build_session_id> --path <artifact_path> [--hash-artifact]');
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const session = service.recordTrainingArtifact(buildSessionId, artifactPath, hasFlag('--hash-artifact'));
+                console.log(JSON.stringify({
+                    build_session_id: session.build_session_id,
+                    artifact_refs_count: session.artifact_refs.length,
+                    latest_artifact: session.artifact_refs.at(-1) ?? null,
+                }, null, 2));
+                return;
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : 'train_artifact_failed');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'status') {
+            try {
+                printTrainStatus(service.getTrainingStatus(buildSessionId));
+                return;
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : 'train_status_failed');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'agent') {
+        const subcommand = args[1];
+        if (subcommand === 'scan') {
+            const result = await service.scanAgents();
+            console.log(`[forkit-connect] Agents detected=${result.agents.length} new=${result.newAgents} known=${result.knownAgents} inactive_marked=${result.inactiveMarked}`);
+            for (const agent of result.agents) {
+                console.log(`- ${agent.agent_name} | type=${agent.agent_type} | status=${agent.status} | id=${shortId(agent.agent_id)} | last_seen_at=${agent.last_seen_at}`);
+            }
+            return;
+        }
+        if (subcommand === 'review') {
+            const snapshot = service.buildAgentReviewSnapshot();
+            if (snapshot.total === 0) {
+                console.log('No agent items found. Run `forkit-connect agent scan` first.');
+                return;
+            }
+            printAgentReview(snapshot);
+            return;
+        }
+        if (subcommand === 'connect') {
+            const selector = args[2];
+            if (!selector) {
+                console.error('Missing required argument: <agentNameOrId>');
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const agent = service.connectAgent(selector);
+                console.log(JSON.stringify({
+                    agent_id: agent.agent_id,
+                    agent_name: agent.agent_name,
+                    agent_type: agent.agent_type,
+                    status: agent.status,
+                }, null, 2));
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'agent_connect_failed';
+                console.error(message === 'AGENT_NOT_FOUND' ? 'Agent not found. Run forkit-connect agent scan first.' : message === 'AGENT_SELECTION_AMBIGUOUS' ? 'Agent selection is ambiguous. Use the full agent_id.' : message);
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'link') {
+            const selector = args[2];
+            if (!selector || !modelName) {
+                console.error('Missing required arguments: agent link <agentNameOrId> --model <modelNameOrDiscoveryHash>');
+                process.exitCode = 2;
+                return;
+            }
+            try {
+                const link = service.linkAgentToModel(selector, modelName);
+                console.log(JSON.stringify(link, null, 2));
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'agent_link_failed';
+                if (message === 'AGENT_NOT_FOUND') {
+                    console.error('Agent not found. Run forkit-connect agent scan first.');
+                }
+                else if (message === 'MODEL_NOT_FOUND') {
+                    console.error('Model not found in local detected models. Run forkit-connect scan first.');
+                }
+                else if (message === 'MODEL_SELECTION_AMBIGUOUS') {
+                    console.error('Model selection is ambiguous. Use the full discoveryHash.');
+                }
+                else if (message === 'AGENT_SELECTION_AMBIGUOUS') {
+                    console.error('Agent selection is ambiguous. Use the full agent_id.');
+                }
+                else {
+                    console.error(message);
+                }
+                process.exitCode = 2;
+                return;
+            }
+        }
+        if (subcommand === 'status') {
+            printAgentStatus(service.getAgentStatus());
+            return;
+        }
+        if (subcommand === 'ledger') {
+            const selector = args[2];
+            try {
+                printAgentLedger(service.getAgentModelUsageLedger(selector));
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'agent_ledger_failed';
+                if (message === 'AGENT_NOT_FOUND') {
+                    console.error('Agent not found. Run forkit-connect agent scan first.');
+                }
+                else if (message === 'AGENT_SELECTION_AMBIGUOUS') {
+                    console.error('Agent selection is ambiguous. Use the full agent_id.');
+                }
+                else {
+                    console.error(message);
+                }
+                process.exitCode = 2;
+                return;
+            }
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'tray') {
+        const subcommand = args[1];
+        if (subcommand === 'status') {
+            const trayStatus = service.getTrayStatus();
+            const menu = service.buildTrayMenuModel();
+            printTrayStatus(trayStatus, menu);
+            return;
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'notify') {
+        const subcommand = args[1];
+        if (subcommand === 'once') {
+            console.log(JSON.stringify(service.deliverPendingNotifications(), null, 2));
+            return;
+        }
+        if (subcommand === 'status') {
+            console.log(JSON.stringify(service.getNotificationStatus(), null, 2));
+            return;
+        }
+        if (subcommand === 'test') {
+            console.log(JSON.stringify(service.sendTestNotification(), null, 2));
+            return;
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'config') {
+        const subcommand = args[1];
+        const key = args[2];
+        const value = args[3];
+        if (subcommand === 'get') {
+            printConfig(service.getConfig());
+            return;
+        }
+        if (subcommand === 'set') {
+            if (key === 'discovery_mode') {
+                if (value !== 'advisory_only' && value !== 'auto_draft') {
+                    console.error('Invalid discovery_mode. Use advisory_only or auto_draft.');
+                    process.exitCode = 2;
+                    return;
+                }
+                printConfig(service.setDiscoveryMode(value));
+                return;
+            }
+            if (key === 'daemon_interval_seconds') {
+                const interval = Number(value);
+                if (!Number.isFinite(interval)) {
+                    console.error('Invalid daemon_interval_seconds. Use a number of seconds.');
+                    process.exitCode = 2;
+                    return;
+                }
+                printConfig(service.setDaemonIntervalSeconds(interval));
+                return;
+            }
+            if (key === 'notifications_enabled') {
+                if (value !== 'true' && value !== 'false') {
+                    console.error('Invalid notifications_enabled. Use true or false.');
+                    process.exitCode = 2;
+                    return;
+                }
+                printConfig(service.setNotificationsEnabled(value === 'true'));
+                return;
+            }
+            if (key === 'notification_min_interval_seconds') {
+                const interval = Number(value);
+                if (!Number.isFinite(interval)) {
+                    console.error('Invalid notification_min_interval_seconds. Use a number of seconds.');
+                    process.exitCode = 2;
+                    return;
+                }
+                printConfig(service.setNotificationMinIntervalSeconds(interval));
+                return;
+            }
+            if (key === 'evolution_bridge_enabled') {
+                if (value !== 'true' && value !== 'false') {
+                    console.error('Invalid evolution_bridge_enabled. Use true or false.');
+                    process.exitCode = 2;
+                    return;
+                }
+                printConfig(service.setEvolutionBridgeEnabled(value === 'true'));
+                return;
+            }
+            console.error('Supported config keys: discovery_mode, daemon_interval_seconds, notifications_enabled, notification_min_interval_seconds, evolution_bridge_enabled');
+            process.exitCode = 2;
+            return;
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'daemon') {
+        const subcommand = args[1];
+        const intervalOverride = intervalSecondsArg !== null ? Number(intervalSecondsArg) : undefined;
+        const hasIntervalOverride = typeof intervalOverride === 'number' && Number.isFinite(intervalOverride);
+        if (subcommand === 'status') {
+            const daemonStatus = service.getDaemonStatus();
+            console.log(JSON.stringify({
+                ...daemonStatus,
+                config: service.getConfig(),
+            }, null, 2));
+            if (daemonStatus.last_scan_summary) {
+                printDiscoverySummary(daemonStatus.last_scan_summary);
+            }
+            return;
+        }
+        if (subcommand === 'health') {
+            console.log(JSON.stringify({
+                ...(0, daemon_1.getDaemonHealth)(service),
+                config: service.getConfig(),
+            }, null, 2));
+            return;
+        }
+        if (subcommand === 'stop') {
+            const stop = await (0, daemon_1.stopDaemonBackground)(service);
+            console.log(stop.message);
+            if (!stop.stopped) {
+                process.exitCode = 2;
+            }
+            return;
+        }
+        if (subcommand === 'run-loop') {
+            if (hasIntervalOverride) {
+                await (0, daemon_1.runDaemonLoopForeground)(service, { intervalSeconds: intervalOverride });
+            }
+            else {
+                await (0, daemon_1.runDaemonLoopForeground)(service);
+            }
+            return;
+        }
+        if (subcommand === 'restart') {
+            const restart = await (0, daemon_1.restartDaemonBackground)(service, __filename, hasIntervalOverride ? intervalOverride : undefined);
+            if (!restart.confirmed) {
+                console.error(restart.message || 'Failed to restart daemon.');
+                process.exitCode = 2;
+                return;
+            }
+            console.log(`Daemon restarted in background. pid=${restart.pid}`);
+            return;
+        }
+        if (subcommand === 'start') {
+            await runPublicDaemonStart();
+            return;
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'pulse') {
+        const subcommand = args[1];
+        const historyLimit = limitArg !== null ? Number(limitArg) : 20;
+        if (subcommand === 'once') {
+            const summary = await service.runVitalityPulseCycle();
+            printPulseSummary(summary);
+            return;
+        }
+        if (subcommand === 'status') {
+            const state = service.getStateStore().readState();
+            console.log(JSON.stringify({
+                last_pulse_at: state.last_pulse_at,
+                last_pulse_error: state.last_pulse_error,
+            }, null, 2));
+            if (state.last_pulse_summary) {
+                printPulseSummary(state.last_pulse_summary);
+            }
+            else {
+                console.log('No pulse summary recorded yet. Run `forkit-connect pulse once` first.');
+            }
+            return;
+        }
+        if (subcommand === 'history') {
+            if (!Number.isFinite(historyLimit) || historyLimit <= 0) {
+                console.error('Invalid --limit value. Use a positive number.');
+                process.exitCode = 2;
+                return;
+            }
+            const events = service.getPulseHistory(historyLimit);
+            if (events.length === 0) {
+                console.log('No pulse history recorded yet. Run `forkit-connect pulse once` first.');
+                return;
+            }
+            printPulseHistory(events, Math.floor(historyLimit));
+            return;
+        }
+        usage();
+        process.exitCode = 1;
+        return;
+    }
+    if (command === 'update-check') {
+        await runPublicUpdateCheck();
+        return;
+    }
+    if (command === 'bound') {
+        const state = service.getStateStore().readState();
+        const bindings = Array.isArray(state.model_bindings)
+            ? state.model_bindings.filter((binding) => binding.status !== 'ignored')
+            : [];
+        console.log(`Bound models: ${bindings.length}`);
+        if (bindings.length === 0) {
+            console.log('No model passports are bound yet.');
+            return;
+        }
+        const sessionRef = String(service.readSessionRef() || '').trim();
+        const api = sessionRef
+            ? new api_1.ConnectApiClient({
+                baseUrl: DEFAULT_BASE_URL,
+                sessionRef,
+            })
+            : null;
+        for (const binding of bindings) {
+            const detectedModel = state.detected_models.find((item) => `${item.model}#${item.digest}` === binding.modelKey);
+            const modelName = detectedModel?.model || (0, heartbeat_1.readBoundModelName)(binding.modelKey);
+            const gaid = String(binding.gaid || 'n/a');
+            const localDraftId = String(binding.draftId || 'n/a');
+            const localWorkspaceId = String(state.workspace_binding.workspaceId || 'n/a');
+            const localProjectId = String(state.project_binding.projectId || 'n/a');
+            const runtime = detectedModel?.runtime || 'n/a';
+            const source = detectedModel?.sourceLabel || 'n/a';
+            console.log(`- ${modelName}`);
+            console.log(`  GAID: ${gaid}`);
+            console.log(`  Draft ID: ${localDraftId}`);
+            console.log(`  Workspace: ${localWorkspaceId}`);
+            console.log(`  Project: ${localProjectId}`);
+            console.log(`  Runtime: ${runtime}`);
+            console.log(`  Source: ${source}`);
+            console.log(`  Status: ${binding.status}`);
+            if (api && binding.gaid) {
+                const verifyResult = await api.getPassport(binding.gaid);
+                if (verifyResult.ok && isPassportResponse(verifyResult.body) && verifyResult.body.passport) {
+                    console.log('  Backend: verified');
+                }
+                else if (verifyResult.status === 404) {
+                    console.log('  Backend: missing (404)');
+                }
+                else if (verifyResult.status === 403) {
+                    console.log('  Backend: inaccessible (403)');
+                }
+                else if (verifyResult.status === 400) {
+                    console.log('  Backend: invalid GAID (400)');
+                }
+                else {
+                    console.log(`  Backend: lookup failed (${verifyResult.status})`);
+                }
+            }
+        }
+        return;
+    }
+    if (command === 'heartbeat') {
+        const updateCheck = await (0, update_1.checkForUpdates)();
+        if (updateCheck.ok && updateCheck.availability === 'required-update') {
+            printUpdateCheckLines((0, update_1.formatUpdateCheckLines)(updateCheck), true);
+            process.exitCode = 2;
+            return;
+        }
+        const heartbeatResult = await (0, heartbeat_1.sendBoundHeartbeat)(service, { baseUrl: DEFAULT_BASE_URL });
+        if (!heartbeatResult.ok) {
+            console.error(heartbeatResult.message);
+            if (heartbeatResult.code === 'heartbeat_failed' && heartbeatResult.details) {
+                console.error(typeof heartbeatResult.details === 'string' ? heartbeatResult.details : JSON.stringify(heartbeatResult.details));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        console.log('Runtime heartbeat sent.');
+        console.log(`Passport GAID: ${heartbeatResult.gaid}`);
+        console.log(`Session ID: ${heartbeatResult.sessionId}`);
+        if (heartbeatResult.lastCheckinAt) {
+            console.log(`Last Check-in: ${heartbeatResult.lastCheckinAt}`);
+        }
+        if (updateCheck.ok && updateCheck.availability === 'update-available') {
+            printUpdateCheckLines((0, update_1.formatUpdateCheckLines)(updateCheck));
+        }
+        return;
+    }
+    if (command === 'workspaces') {
+        const state = service.getStateStore().readState();
+        const sessionRef = String(service.readSessionRef() || '').trim();
+        if (!sessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef,
+        });
+        const result = await api.getProfileAccess();
+        if (!result.ok || !isProfileAccessResponse(result.body)) {
+            console.error(`[forkit-connect] Workspace listing failed (${result.status}).`);
+            if (result.body) {
+                console.error(typeof result.body === 'string' ? result.body : JSON.stringify(result.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        const payload = result.body;
+        const tokenPayload = parseJwtPayload(sessionRef);
+        const email = typeof tokenPayload?.email === 'string' ? tokenPayload.email : null;
+        const platformRole = typeof payload.summary?.platformRole === 'string'
+            ? payload.summary.platformRole
+            : typeof tokenPayload?.role === 'string'
+                ? tokenPayload.role
+                : null;
+        if (email || platformRole) {
+            const identityParts = [
+                email ? `account=${email}` : null,
+                platformRole ? `platform_role=${platformRole}` : null,
+            ].filter(Boolean);
+            console.log(`[forkit-connect] ${identityParts.join(' | ')}`);
+        }
+        const workspaces = Array.isArray(payload.workspaces) ? payload.workspaces : [];
+        console.log(`[forkit-connect] Workspaces: ${workspaces.length}`);
+        if (workspaces.length === 0) {
+            console.log('[forkit-connect] No accessible workspaces returned by /api/profiles/access.');
+            return;
+        }
+        for (const workspace of workspaces) {
+            console.log(formatWorkspaceAccessLine(workspace));
+        }
+        return;
+    }
+    if (command === 'projects') {
+        const state = service.getStateStore().readState();
+        const sessionRef = String(service.readSessionRef() || '').trim();
+        if (!sessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        if (!workspaceId) {
+            console.error('Missing required argument: --workspace <workspaceId>');
+            process.exitCode = 2;
+            return;
+        }
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef,
+        });
+        const result = await api.getWorkspaceProjects(workspaceId);
+        if (!result.ok) {
+            if (result.status === 403 || result.status === 404 || result.status === 400) {
+                console.error('Workspace not found or not accessible.');
+                process.exitCode = 2;
+                return;
+            }
+            console.error(`[forkit-connect] Project listing failed (${result.status}).`);
+            if (result.body) {
+                console.error(typeof result.body === 'string' ? result.body : JSON.stringify(result.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        if (!isWorkspaceProjectsResponse(result.body)) {
+            console.error(`[forkit-connect] Project listing failed (${result.status}).`);
+            process.exitCode = 2;
+            return;
+        }
+        console.log('Authenticated successfully.');
+        const projects = Array.isArray(result.body.projects) ? result.body.projects : [];
+        console.log(`Projects: ${projects.length}`);
+        if (projects.length === 0) {
+            console.log('No projects found in this workspace.');
+            console.log('Run `forkit-connect workspace select --workspace <id> --project-name "<name>"` to create the first project here.');
+            return;
+        }
+        for (const project of projects) {
+            console.log(formatWorkspaceProjectLine(project));
+        }
+        return;
+    }
+    if (command === 'bind') {
+        const state = service.getStateStore().readState();
+        const storedSessionRef = String(service.readSessionRef() || '').trim();
+        if (!storedSessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        if (!workspaceId) {
+            console.error('Missing required argument: --workspace <workspaceId>');
+            process.exitCode = 2;
+            return;
+        }
+        if (!projectId) {
+            console.error('Missing required argument: --project <projectId>');
+            process.exitCode = 2;
+            return;
+        }
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: storedSessionRef,
+        });
+        const accessResult = await api.getProfileAccess();
+        if (!accessResult.ok || !isProfileAccessResponse(accessResult.body)) {
+            console.error(`[forkit-connect] Workspace validation failed (${accessResult.status}).`);
+            if (accessResult.body) {
+                console.error(typeof accessResult.body === 'string' ? accessResult.body : JSON.stringify(accessResult.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        const workspaces = Array.isArray(accessResult.body.workspaces) ? accessResult.body.workspaces : [];
+        const isAccessibleWorkspace = workspaces.some((workspace) => String(workspace.id || '').trim() === workspaceId);
+        if (!isAccessibleWorkspace) {
+            console.error('Workspace not found or not accessible.');
+            process.exitCode = 2;
+            return;
+        }
+        const projectsResult = await api.getWorkspaceProjects(workspaceId);
+        if (!projectsResult.ok) {
+            if (projectsResult.status === 400 || projectsResult.status === 403 || projectsResult.status === 404) {
+                console.error('Workspace not found or not accessible.');
+                process.exitCode = 2;
+                return;
+            }
+            console.error(`[forkit-connect] Project validation failed (${projectsResult.status}).`);
+            if (projectsResult.body) {
+                console.error(typeof projectsResult.body === 'string' ? projectsResult.body : JSON.stringify(projectsResult.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        if (!isWorkspaceProjectsResponse(projectsResult.body)) {
+            console.error(`[forkit-connect] Project validation failed (${projectsResult.status}).`);
+            process.exitCode = 2;
+            return;
+        }
+        const projects = Array.isArray(projectsResult.body.projects) ? projectsResult.body.projects : [];
+        const belongsToWorkspace = projects.some((project) => String(project.id || '').trim() === projectId);
+        if (!belongsToWorkspace) {
+            console.error('Project not found in workspace.');
+            process.exitCode = 2;
+            return;
+        }
+        const bindingResult = await service.bindWorkspaceProject(workspaceId, projectId);
+        console.log(bindingResult.message);
+        console.log(`Workspace: ${bindingResult.workspaceId ?? workspaceId}`);
+        console.log(`Project: ${bindingResult.projectId ?? projectId}`);
+        return;
+    }
+    if (command === 'register') {
+        if (hasFlag('--all-ready') || !getArg('--model')) {
+            await runPublicRegister();
+            return;
+        }
+        const state = service.getStateStore().readState();
+        const storedSessionRef = String(service.readSessionRef() || '').trim();
+        if (!storedSessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        const boundWorkspaceId = String(state.workspace_binding.workspaceId || '').trim();
+        const boundProjectId = String(state.project_binding.projectId || '').trim();
+        if (!boundWorkspaceId || !boundProjectId) {
+            console.error('No workspace/project bound. Run forkit-connect bind first.');
+            process.exitCode = 2;
+            return;
+        }
+        if (!modelName) {
+            console.error('Missing required argument: --model <modelName>');
+            process.exitCode = 2;
+            return;
+        }
+        const detectedModels = Array.isArray(state.detected_models) ? state.detected_models : [];
+        const model = detectedModels.find((item) => item.model === modelName && item.status !== 'ignored');
+        if (!model) {
+            console.error('Model not found in local detected models. Run forkit-connect scan first.');
+            process.exitCode = 2;
+            return;
+        }
+        const modelKey = `${model.model}#${model.digest}`;
+        const existingBinding = (state.model_bindings || []).find((binding) => binding.modelKey === modelKey && binding.status !== 'ignored');
+        if (existingBinding?.draftId) {
+            console.error('Model already registered. No duplicate draft created.');
+            process.exitCode = 2;
+            return;
+        }
+        const payload = {
+            passportType: 'model',
+            name: model.model,
+            metadata: {
+                passport_type: 'model',
+                runtime: model.runtime,
+                provider: model.runtime,
+                detection_source: model.sourceLabel,
+                workspaceId: boundWorkspaceId,
+                projectId: boundProjectId,
+                workspace_id: boundWorkspaceId,
+                project_id: boundProjectId,
+                digest: model.digest,
+                sizeBytes: model.sizeBytes,
+                modifiedAt: model.modifiedAt,
+                detectedAt: model.detectedAt,
+                connection_status: 'polling_ready',
+            },
+            originChannel: 'cli',
+            originTool: 'forkit-connect',
+            workspaceId: boundWorkspaceId,
+            projectId: boundProjectId,
+            connectionStatus: 'polling_ready',
+        };
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: storedSessionRef,
+        });
+        const result = await api.createPassportDraft(payload);
+        if (!result.ok) {
+            if (result.status === 409) {
+                console.error('Model already registered in backend. No duplicate draft created.');
+                process.exitCode = 2;
+                return;
+            }
+            console.error(`[forkit-connect] Model registration failed (${result.status}).`);
+            if (result.body) {
+                console.error(typeof result.body === 'string' ? result.body : JSON.stringify(result.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        const responseBody = result.body && typeof result.body === 'object'
+            ? result.body
+            : null;
+        const draft = responseBody?.draft && typeof responseBody.draft === 'object'
+            ? responseBody.draft
+            : null;
+        const passport = responseBody?.passport && typeof responseBody.passport === 'object'
+            ? responseBody.passport
+            : null;
+        const draftId = typeof draft?.id === 'string'
+            ? draft.id
+            : typeof responseBody?.id === 'string'
+                ? responseBody.id
+                : null;
+        const gaid = typeof passport?.gaid === 'string'
+            ? passport.gaid
+            : typeof draft?.gaid === 'string'
+                ? draft.gaid
+                : null;
+        service.getStateStore().upsertModelBinding({
+            modelKey,
+            discoveryHash: model.discoveryHash,
+            registrationKey: (0, discovery_1.buildModelRegistrationKey)(model, state.runtime_identity.runtimeId),
+            gaid,
+            draftId,
+            status: 'pending',
+            updatedAt: new Date().toISOString(),
+        });
+        service.getStateStore().addEvidenceEvent({
+            type: 'model_draft_created',
+            details: {
+                model: model.model,
+                digest: model.digest,
+                workspaceId: boundWorkspaceId,
+                projectId: boundProjectId,
+                draftId,
+                gaid,
+                backendStatus: result.status,
+            },
+        });
+        console.log('Model registration draft created.');
+        if (draftId) {
+            console.log(`Draft ID: ${draftId}`);
+        }
+        if (gaid) {
+            console.log(`Passport GAID: ${gaid}`);
+        }
+        return;
+    }
+    if (command === 'drafts') {
+        const state = service.getStateStore().readState();
+        const storedSessionRef = String(service.readSessionRef() || '').trim();
+        if (!storedSessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: storedSessionRef,
+        });
+        const result = await api.getPassportDrafts();
+        if (!result.ok || !isPassportDraftListResponse(result.body)) {
+            console.error(`[forkit-connect] Draft listing failed (${result.status}).`);
+            if (result.body) {
+                console.error(typeof result.body === 'string' ? result.body : JSON.stringify(result.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        const drafts = Array.isArray(result.body.drafts) ? result.body.drafts : [];
+        console.log(`Drafts: ${drafts.length}`);
+        if (drafts.length === 0) {
+            console.log('No drafts found.');
+            return;
+        }
+        for (const draft of drafts) {
+            console.log(formatDraftLine(draft));
+        }
+        return;
+    }
+    if (command === 'publish') {
+        const state = service.getStateStore().readState();
+        const storedSessionRef = String(service.readSessionRef() || '').trim();
+        if (!storedSessionRef) {
+            console.error('Not authenticated. Run forkit-connect login first.');
+            process.exitCode = 2;
+            return;
+        }
+        if (!draftId) {
+            console.error('Missing required argument: --draft <draftId>');
+            process.exitCode = 2;
+            return;
+        }
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: storedSessionRef,
+        });
+        const lookupResult = await api.getPassportDraft(draftId);
+        if (!lookupResult.ok) {
+            if (lookupResult.status === 403 || lookupResult.status === 404) {
+                console.error('Draft not found or not accessible.');
+                process.exitCode = 2;
+                return;
+            }
+            console.error(`[forkit-connect] Draft lookup failed (${lookupResult.status}).`);
+            if (lookupResult.body) {
+                console.error(typeof lookupResult.body === 'string' ? lookupResult.body : JSON.stringify(lookupResult.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        if (!isPassportDraftResponse(lookupResult.body) || !lookupResult.body.draft) {
+            console.error('Draft not found or not accessible.');
+            process.exitCode = 2;
+            return;
+        }
+        const publishResult = await api.publishPassportDraft(draftId);
+        if (!publishResult.ok) {
+            if (publishResult.status === 403 || publishResult.status === 404) {
+                console.error('Draft not found or not accessible.');
+                process.exitCode = 2;
+                return;
+            }
+            if (publishResult.status === 409) {
+                const body = publishResult.body && typeof publishResult.body === 'object'
+                    ? publishResult.body
+                    : null;
+                const passport = body?.passport && typeof body.passport === 'object'
+                    ? body.passport
+                    : null;
+                const gaid = typeof passport?.gaid === 'string' ? passport.gaid : null;
+                console.error(gaid ? `Draft already published: ${gaid}` : 'Draft already published.');
+                process.exitCode = 2;
+                return;
+            }
+            const body = publishResult.body && typeof publishResult.body === 'object'
+                ? publishResult.body
+                : null;
+            const message = typeof body?.error === 'string' ? body.error : null;
+            console.error(message || `[forkit-connect] Draft publish failed (${publishResult.status}).`);
+            if (publishResult.body) {
+                console.error(typeof publishResult.body === 'string' ? publishResult.body : JSON.stringify(publishResult.body));
+            }
+            process.exitCode = 2;
+            return;
+        }
+        if (!isPassportDraftPublishResponse(publishResult.body) || !publishResult.body.passport) {
+            console.error(`[forkit-connect] Draft publish failed (${publishResult.status}).`);
+            process.exitCode = 2;
+            return;
+        }
+        const passport = publishResult.body.passport;
+        const publishedGaid = typeof passport.gaid === 'string' ? passport.gaid : null;
+        const bindingState = service.getStateStore().readState();
+        const matchingBinding = bindingState.model_bindings.find((binding) => binding.draftId === draftId);
+        if (matchingBinding) {
+            service.getStateStore().upsertModelBinding({
+                ...matchingBinding,
+                gaid: publishedGaid,
+                status: 'bound',
+                updatedAt: new Date().toISOString(),
+            });
+        }
+        service.getStateStore().addEvidenceEvent({
+            type: 'model_passport_created',
+            details: {
+                draftId,
+                gaid: publishedGaid,
+                passportId: passport.id ?? null,
+                passportType: passport.passportType ?? null,
+                workspaceId: passport.workspaceId ?? null,
+                projectId: passport.projectId ?? null,
+                backendStatus: publishResult.status,
+            },
+        });
+        service.getStateStore().addEvidenceEvent({
+            type: 'passport_bound',
+            details: {
+                draftId,
+                gaid: publishedGaid,
+            },
+        });
+        service.recordC2LifecycleEvent({
+            eventType: 'connect_passport_bound',
+            passportGaid: publishedGaid,
+            workspaceId: String(passport.workspaceId || state.workspace_binding.workspaceId || '').trim() || null,
+            projectId: String(passport.projectId || state.project_binding.projectId || '').trim() || null,
+            metadata: {
+                draft_id: draftId,
+                passport_id: passport.id ?? null,
+                connection_status: passport.connectionStatus ?? null,
+            },
+        });
+        service.markBuildSessionDraftPublished(draftId, publishedGaid, String(passport.workspaceId || state.workspace_binding.workspaceId || '').trim() || null, String(passport.projectId || state.project_binding.projectId || '').trim() || null);
+        console.log('Draft published successfully.');
+        if (publishedGaid) {
+            console.log(`Passport GAID: ${publishedGaid}`);
+        }
+        return;
+    }
+    if (command === 'scan' || command === 'discover') {
+        await runPublicScan();
+        return;
+    }
+    if (command === 'login') {
+        await runPublicLogin();
+        return;
+    }
+    if (command === 'logout') {
+        runPublicLogout();
+        return;
+    }
+    if (command === 'doctor') {
+        const checks = await service.runDoctorChecks();
+        for (const check of checks) {
+            console.log(`[${check.status}] ${check.name}: ${check.details}`);
+        }
+        if (checks.some((check) => check.status === 'FAIL')) {
+            process.exitCode = 2;
+        }
+        return;
+    }
+    showUsage();
+    process.exitCode = 1;
+}
+void run().catch((error) => {
+    const message = error instanceof Error ? error.message : 'forkit_connect_cli_failed';
+    console.error(`[forkit-connect] ${message}`);
+    process.exitCode = 2;
+});
+//# sourceMappingURL=cli.js.map