npm - forkit-connect - Versions diffs - 0.1.34 → 0.1.36 - Mend

forkit-connect 0.1.34 → 0.1.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/dist/launcher.js +267 -2
package/dist/v1/api.d.ts +13 -0
package/dist/v1/api.js +27 -0
package/dist/v1/filesystem-models.js +3 -0
package/dist/v1/service.d.ts +33 -1
package/dist/v1/service.js +503 -37
package/dist/v1/state.d.ts +2 -0
package/dist/v1/state.js +77 -1
package/dist/v1/types.d.ts +3 -1
package/package.json +1 -1

package/dist/launcher.js CHANGED Viewed

@@ -58,6 +58,17 @@ function formatApiFailureMessage(fallback, status, body) {
         return `${fallback} (${explicitCode}).`;
     return `${fallback} (${status}).`;
 }
+function formatAgentTypeLabel(value) {
+    return String(value || 'agent')
+        .split(/[_-]+/)
+        .filter(Boolean)
+        .map((part) => part.toLowerCase() === 'ai' ? 'AI' : `${part.charAt(0).toUpperCase()}${part.slice(1).toLowerCase()}`)
+        .join(' ');
+}
+function formatLocalSourceLabel(value) {
+    const source = String(value || 'Local device').trim();
+    return source || 'Local device';
+}
 function resolveLauncherOperatingMode(service) {
     const entitlements = service.getServiceEntitlements();
     const normalizedTier = String(entitlements.tier || '').trim().toLowerCase();
@@ -1328,6 +1339,186 @@ function buildHealthPayload(service, host, port) {
         },
     };
 }
+function renderAgentHandoffHtml(launcherToken) {
+    const safeLauncherToken = JSON.stringify(launcherToken);
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Connect your Agent · Forkit Connect</title>
+  <style>
+    :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; color: #f7efe4; background: radial-gradient(circle at 50% 0%, #24213c 0, #10131d 46%, #090d14 100%); }
+    main { width: min(720px, calc(100% - 32px)); margin: 0 auto; padding: 52px 0; }
+    .brand { display: flex; align-items: center; gap: 12px; margin-bottom: 34px; color: #9deef5; font-size: 13px; font-weight: 800; letter-spacing: .15em; text-transform: uppercase; }
+    .brand img { width: 34px; height: 34px; }
+    .panel { border: 1px solid rgba(157,238,245,.22); border-radius: 28px; padding: clamp(24px, 5vw, 42px); background: rgba(20,22,34,.94); box-shadow: 0 30px 80px rgba(0,0,0,.34); }
+    .eyebrow { margin: 0 0 10px; color: #9deef5; font-size: 12px; font-weight: 800; letter-spacing: .16em; text-transform: uppercase; }
+    h1 { margin: 0; font-size: clamp(30px, 6vw, 48px); line-height: 1.06; letter-spacing: -.04em; }
+    .lead { margin: 14px 0 0; color: rgba(247,239,228,.72); font-size: 16px; line-height: 1.55; }
+    .passport { margin: 24px 0; padding: 16px 18px; border-radius: 18px; background: rgba(157,238,245,.08); border: 1px solid rgba(157,238,245,.14); }
+    .passport strong { display: block; font-size: 17px; }
+    .passport span { display: block; margin-top: 5px; color: rgba(247,239,228,.62); font-size: 12px; overflow-wrap: anywhere; }
+    .agents { display: grid; gap: 10px; margin: 18px 0 24px; }
+    .agent { width: 100%; display: flex; align-items: center; gap: 14px; padding: 16px; color: inherit; text-align: left; border: 1px solid rgba(247,239,228,.14); border-radius: 18px; background: rgba(255,255,255,.035); cursor: pointer; }
+    .agent:hover, .agent.selected { border-color: #9deef5; background: rgba(157,238,245,.1); }
+    .agent-mark { width: 38px; height: 38px; display: grid; place-items: center; flex: 0 0 auto; border-radius: 12px; color: #121522; background: #9deef5; font-weight: 900; }
+    .agent-copy { min-width: 0; flex: 1; }
+    .agent-name { display: block; font-size: 16px; font-weight: 750; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+    .agent-meta { display: block; margin-top: 4px; color: rgba(247,239,228,.62); font-size: 13px; }
+    .check { opacity: 0; color: #9deef5; font-weight: 900; }
+    .agent.selected .check { opacity: 1; }
+    .actions { display: flex; gap: 12px; align-items: center; flex-wrap: wrap; }
+    button, .button { min-height: 48px; padding: 0 20px; border-radius: 15px; border: 1px solid rgba(247,239,228,.16); font: inherit; font-weight: 750; cursor: pointer; text-decoration: none; display: inline-flex; align-items: center; justify-content: center; }
+    .primary { border-color: transparent; color: #19142b; background: linear-gradient(135deg, #9deef5, #f49355); }
+    .secondary { color: #f7efe4; background: transparent; }
+    button:disabled { opacity: .45; cursor: not-allowed; }
+    .status { margin: 18px 0 0; min-height: 24px; color: rgba(247,239,228,.7); font-size: 14px; }
+    .status.error { color: #ffb7c2; }
+    .privacy { margin: 22px 0 0; color: rgba(247,239,228,.52); font-size: 12px; line-height: 1.5; }
+    [hidden] { display: none !important; }
+    @media (max-width: 560px) { main { padding: 24px 0; } .panel { border-radius: 22px; } .actions > * { width: 100%; } }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="brand"><img src="/assets/logo.svg" alt=""><span>Forkit Connect</span></div>
+    <section class="panel">
+      <p class="eyebrow">Agent connection</p>
+      <h1 id="title">Connect your Agent</h1>
+      <p class="lead" id="lead">Checking this connection request…</p>
+      <div class="passport" id="passport" hidden><strong id="passport-name"></strong><span id="passport-id"></span></div>
+      <div id="agent-section" hidden>
+        <p class="eyebrow">Detected on this device</p>
+        <div class="agents" id="agents"></div>
+      </div>
+      <div class="actions">
+        <button class="primary" id="approve" hidden disabled>Approve &amp; connect</button>
+        <button class="primary" id="sign-in" hidden>Sign in to Forkit</button>
+        <a class="button primary" id="return" hidden>Return to Forkit</a>
+        <button class="secondary" id="decline">Not now</button>
+      </div>
+      <p class="status" id="status" role="status" aria-live="polite"></p>
+      <p class="privacy">Forkit records connection and operational metadata only. It does not collect prompts, responses, file contents, browser content, emails or credentials.</p>
+    </section>
+  </main>
+  <script>
+    const launcherToken = ${safeLauncherToken};
+    const query = new URLSearchParams(window.location.search);
+    const fragment = new URLSearchParams(window.location.hash.slice(1));
+    const handoffToken = fragment.get('handoff') || '';
+    const expectedPassport = query.get('passport') || '';
+    window.history.replaceState(null, '', window.location.pathname + window.location.search);
+    let selectedAgent = '';
+    let returnUrl = 'https://www.forkit.dev/register-passport?connect=' + encodeURIComponent(expectedPassport);
+    try {
+      const candidate = new URL(query.get('returnTo') || '');
+      const local = candidate.protocol === 'http:' && (candidate.hostname === '127.0.0.1' || candidate.hostname === 'localhost');
+      if (candidate.origin === 'https://www.forkit.dev' || local) returnUrl = candidate.href;
+    } catch {}
+    const byId = (id) => document.getElementById(id);
+    const escapeHtml = (value) => String(value || '').replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[char]));
+    async function api(path, options = {}) {
+      const response = await fetch(path, {
+        ...options,
+        headers: { 'content-type': 'application/json', 'x-forkit-launcher-token': launcherToken, ...(options.headers || {}) },
+      });
+      const body = await response.json().catch(() => ({}));
+      return { response, body };
+    }
+    function setStatus(message, error = false) {
+      byId('status').textContent = message || '';
+      byId('status').classList.toggle('error', error);
+    }
+    function showSignIn() {
+      byId('lead').textContent = 'Sign in once to verify that this Passport belongs to you.';
+      byId('sign-in').hidden = false;
+      setStatus('');
+    }
+    function renderPreview(body) {
+      const passport = body.handoff.passport;
+      if (expectedPassport && passport.gaid !== expectedPassport) throw new Error('The Passport request does not match.');
+      byId('lead').textContent = 'Choose the matching Agent, then approve once.';
+      byId('passport-name').textContent = passport.name;
+      byId('passport-id').textContent = passport.gaid;
+      byId('passport').hidden = false;
+      byId('agent-section').hidden = false;
+      byId('approve').hidden = false;
+      const agents = Array.isArray(body.agents) ? body.agents : [];
+      byId('agents').innerHTML = agents.map((agent) => '<button class="agent" type="button" data-agent="' + escapeHtml(agent.id) + '"><span class="agent-mark">A</span><span class="agent-copy"><span class="agent-name">' + escapeHtml(agent.name) + '</span><span class="agent-meta">' + escapeHtml(agent.typeLabel) + ' · ' + escapeHtml(agent.source) + '</span></span><span class="check">✓</span></button>').join('');
+      if (agents.length === 1) selectedAgent = agents[0].id;
+      for (const card of byId('agents').querySelectorAll('.agent')) {
+        if (card.dataset.agent === selectedAgent) card.classList.add('selected');
+        card.addEventListener('click', () => {
+          selectedAgent = card.dataset.agent || '';
+          for (const other of byId('agents').querySelectorAll('.agent')) other.classList.toggle('selected', other === card);
+          byId('approve').disabled = !selectedAgent;
+        });
+      }
+      byId('approve').disabled = !selectedAgent;
+      setStatus(agents.length ? '' : 'No supported Agent is active on this device.', !agents.length);
+    }
+    async function load() {
+      if (query.get('action') !== 'connect-agent' || !handoffToken) {
+        byId('lead').textContent = 'Open this page from your Agent Passport on Forkit.dev.';
+        setStatus('The connection request is missing or invalid.', true);
+        return;
+      }
+      const { response, body } = await api('/api/agent-handoff/preview', { method: 'POST', body: JSON.stringify({ handoffToken }) });
+      if (response.status === 401 && body.requiresSignIn) { showSignIn(); return; }
+      if (!response.ok || !body.ok) throw new Error(body.message || 'The connection request could not be verified.');
+      renderPreview(body);
+    }
+    byId('approve').addEventListener('click', async () => {
+      if (!selectedAgent) return;
+      byId('approve').disabled = true;
+      setStatus('Connecting securely…');
+      try {
+        const { response, body } = await api('/api/agent-handoff/approve', { method: 'POST', body: JSON.stringify({ handoffToken, agentSelector: selectedAgent }) });
+        if (!response.ok || !body.ok) throw new Error(body.message || 'Connection failed.');
+        byId('title').textContent = 'Connected';
+        byId('lead').textContent = body.activityConfirmed ? 'Forkit received the connection event.' : 'The connection is saved and will sync when the service is available.';
+        byId('agent-section').hidden = true;
+        byId('approve').hidden = true;
+        byId('decline').hidden = true;
+        byId('return').href = returnUrl;
+        byId('return').hidden = false;
+        setStatus(body.agentName + ' is linked to ' + body.passportName + '.');
+      } catch (error) {
+        byId('approve').disabled = false;
+        setStatus(error.message || 'Connection failed.', true);
+      }
+    });
+    byId('sign-in').addEventListener('click', async () => {
+      byId('sign-in').disabled = true;
+      setStatus('Preparing sign-in…');
+      try {
+        const { response, body } = await api('/api/login/start', { method: 'POST', body: '{}' });
+        if (!response.ok || !body.ok) throw new Error(body.message || 'Sign-in could not start.');
+        window.open(body.verificationUrl, '_blank', 'noopener,noreferrer');
+        const poll = window.setInterval(async () => {
+          const result = await api('/api/login/poll?deviceCode=' + encodeURIComponent(body.deviceCode));
+          if (result.body && result.body.approved) {
+            window.clearInterval(poll);
+            byId('sign-in').hidden = true;
+            setStatus('Signed in. Verifying the request…');
+            load().catch((error) => setStatus(error.message, true));
+          }
+        }, Math.max(2000, Number(body.pollIntervalSeconds || 3) * 1000));
+      } catch (error) {
+        byId('sign-in').disabled = false;
+        setStatus(error.message || 'Sign-in could not start.', true);
+      }
+    });
+    byId('decline').addEventListener('click', () => { window.location.href = returnUrl; });
+    load().catch((error) => { byId('lead').textContent = 'Return to Forkit.dev and try again.'; setStatus(error.message || 'Connection failed.', true); });
+  </script>
+</body>
+</html>`;
+}
 function renderLauncherHtml(launcherToken) {
     return `<!doctype html>
 <html lang="en">
@@ -11252,8 +11443,11 @@ function createLauncherApp(options) {
     app.get('/assets/logo-2line.svg', (_request, response) => {
         response.type('image/svg+xml').sendFile(getLogoTwoLineSourcePath());
     });
-    app.get('/', (_request, response) => {
-        response.type('html').send(renderLauncherHtml(launcherToken));
+    app.get('/', (request, response) => {
+        const isAgentHandoff = request.query.action === 'connect-agent';
+        response.type('html').send(isAgentHandoff
+            ? renderAgentHandoffHtml(launcherToken)
+            : renderLauncherHtml(launcherToken));
     });
     app.use('/api', createApiRequestGuard(getBoundPort, launcherToken));
     app.get('/api/health', (_request, response) => {
@@ -11497,6 +11691,77 @@ function createLauncherApp(options) {
             sendInternalError(response, error, 'launcher_discovery_failed');
         }
     });
+    app.post('/api/agent-handoff/preview', async (request, response) => {
+        try {
+            const handoffToken = typeof request.body?.handoffToken === 'string' ? request.body.handoffToken.trim() : '';
+            if (!handoffToken) {
+                response.status(400).json({ ok: false, message: 'The connection request is missing.' });
+                return;
+            }
+            const handoff = await options.service.resolveWebsiteAgentHandoff(handoffToken);
+            const scan = await options.service.scanAgents({ includeConnectSelf: false });
+            const agents = scan.agents
+                .filter((agent) => agent.status !== 'inactive' && agent.metadata?.signature !== 'forkit-connect-desktop')
+                .map((agent) => ({
+                id: agent.agent_id,
+                name: agent.agent_name,
+                typeLabel: formatAgentTypeLabel(agent.agent_type),
+                source: formatLocalSourceLabel(agent.process_name),
+                status: agent.status,
+            }));
+            response.json({ ok: true, handoff, agents });
+        }
+        catch (error) {
+            const code = error instanceof Error ? error.message : 'AGENT_HANDOFF_FAILED';
+            const requiresSignIn = code === 'AGENT_HANDOFF_SIGN_IN_REQUIRED';
+            const status = requiresSignIn ? 401 : code === 'AGENT_HANDOFF_ACCOUNT_MISMATCH' ? 403 : 400;
+            response.status(status).json({
+                ok: false,
+                requiresSignIn,
+                message: requiresSignIn
+                    ? 'Sign in to verify this Agent Passport.'
+                    : 'This Agent connection request is invalid or has expired.',
+            });
+        }
+    });
+    app.post('/api/agent-handoff/approve', async (request, response) => {
+        try {
+            const handoffToken = typeof request.body?.handoffToken === 'string' ? request.body.handoffToken.trim() : '';
+            const agentSelector = typeof request.body?.agentSelector === 'string' ? request.body.agentSelector.trim() : '';
+            if (!handoffToken || !agentSelector) {
+                response.status(400).json({ ok: false, message: 'Choose an Agent to continue.' });
+                return;
+            }
+            const result = await options.service.approveWebsiteAgentHandoff({ handoffToken, agentSelector });
+            response.json({
+                ok: true,
+                action: result.action,
+                agentName: result.agent.agent_name,
+                passportName: result.passport.name,
+                passportGaid: result.passport.gaid,
+                activityConfirmed: result.activityConfirmed,
+                syncPending: result.syncPending,
+            });
+        }
+        catch (error) {
+            const code = error instanceof Error ? error.message : 'AGENT_HANDOFF_FAILED';
+            const status = code === 'AGENT_HANDOFF_SIGN_IN_REQUIRED'
+                ? 401
+                : code === 'AGENT_ALREADY_CONNECTED_TO_ANOTHER_PASSPORT'
+                    ? 409
+                    : code === 'SECURE_STORAGE_REQUIRED' || code === 'SECURE_STORAGE_WRITE_FAILED'
+                        ? 503
+                        : 400;
+            const message = code === 'AGENT_HANDOFF_SIGN_IN_REQUIRED'
+                ? 'Sign in to verify this Agent Passport.'
+                : code === 'AGENT_ALREADY_CONNECTED_TO_ANOTHER_PASSPORT'
+                    ? 'This Agent is already connected to another Passport.'
+                    : code === 'SECURE_STORAGE_REQUIRED' || code === 'SECURE_STORAGE_WRITE_FAILED'
+                        ? 'Secure credential storage is unavailable on this device.'
+                        : 'The Agent could not be connected. Return to Forkit.dev and try again.';
+            response.status(status).json({ ok: false, message });
+        }
+    });
     app.post('/api/discovery/connect-model', async (request, response) => {
         try {
             const selector = typeof request.body?.selector === 'string' ? request.body.selector.trim() : '';

package/dist/v1/api.d.ts CHANGED Viewed

@@ -156,6 +156,17 @@ export interface ApiKeyCreateResponse {
     rawKey?: string | null;
     _warning?: string | null;
 }
+export interface AgentHandoffResolveResponse {
+    protocol?: 'agent-handoff.v1' | string;
+    expiresAt?: string | null;
+    passport?: {
+        gaid?: string | null;
+        name?: string | null;
+        passportType?: string | null;
+        workspaceId?: string | null;
+        projectId?: string | null;
+    } | null;
+}
 export interface WorkspaceProject {
     id?: string | null;
     workspaceId?: string | null;
@@ -377,6 +388,8 @@ export declare class ConnectApiClient {
      * owned passport. Returns the rawKey exactly once — caller must persist it.
      */
     createPassportApiKey(gaid: string, label?: string): Promise<ApiCallResult>;
+    revokePassportApiKey(gaid: string, keyId: string): Promise<ApiCallResult>;
+    resolveAgentHandoff(handoffToken: string): Promise<ApiCallResult>;
     createRuntimeApiKey(gaid: string, label?: string): Promise<ApiCallResult>;
     private parseBody;
 }

package/dist/v1/api.js CHANGED Viewed

@@ -550,6 +550,33 @@ class ConnectApiClient {
             contract: this.parseContract(res),
         };
     }
+    async revokePassportApiKey(gaid, keyId) {
+        const url = `${this.config.baseUrl}/api/v1/passports/${encodeURIComponent(gaid)}/api-keys/${encodeURIComponent(keyId)}`;
+        const res = await fetch(url, {
+            method: 'DELETE',
+            headers: this.getHeaders(),
+        });
+        return {
+            ok: res.ok,
+            status: res.status,
+            body: await this.parseBody(res),
+            contract: this.parseContract(res),
+        };
+    }
+    async resolveAgentHandoff(handoffToken) {
+        const url = `${this.config.baseUrl}/api/v1/connect/agent-handoffs/resolve`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: this.getHeaders(),
+            body: JSON.stringify({ handoffToken }),
+        });
+        return {
+            ok: res.ok,
+            status: res.status,
+            body: await this.parseBody(res),
+            contract: this.parseContract(res),
+        };
+    }
     async createRuntimeApiKey(gaid, label) {
         const url = `${this.config.baseUrl}/api/v1/runtimes/${encodeURIComponent(gaid)}/api-keys`;
         const res = await fetch(url, {

package/dist/v1/filesystem-models.js CHANGED Viewed

@@ -255,6 +255,9 @@ class FilesystemModelProvider {
 }
 exports.FilesystemModelProvider = FilesystemModelProvider;
 function createDefaultFilesystemModelProviders() {
+    if (process.env.FORKIT_CONNECT_DISABLE_FILESYSTEM_MODEL_SCAN === '1') {
+        return [];
+    }
     const roots = getDefaultFilesystemModelDirs();
     return roots.length > 0 ? [new FilesystemModelProvider(roots)] : [];
 }

package/dist/v1/service.d.ts CHANGED Viewed

@@ -185,6 +185,24 @@ export interface AgentStatusResult {
         lastError: string | null;
     } | null;
 }
+export interface WebsiteAgentHandoff {
+    protocol: 'agent-handoff.v1';
+    expiresAt: string;
+    passport: {
+        gaid: string;
+        name: string;
+        passportType: 'agent';
+        workspaceId: string | null;
+        projectId: string | null;
+    };
+}
+export interface WebsiteAgentHandoffApprovalResult {
+    action: 'connected' | 'already_connected';
+    agent: DetectedAgent;
+    passport: WebsiteAgentHandoff['passport'];
+    activityConfirmed: boolean;
+    syncPending: boolean;
+}
 export interface TrayStatusResult {
     daemonRunning: boolean;
     detectedModels: number;
@@ -427,6 +445,8 @@ export declare class ConnectV1Service {
     private anchorBuildSessionToBinding;
     private resolveRuntimeRunScope;
     private getPrimaryBoundBinding;
+    private getOperationalPassportContext;
+    private recordAgentConnectionFault;
     private setRuntimeSignalApiKeyForGaid;
     private clearRuntimeSignalApiKeyForGaid;
     private resolveRuntimeSignalApiKeyForEvent;
@@ -512,6 +532,7 @@ export declare class ConnectV1Service {
     };
     private buildC2LifecycleEvent;
     private recordC2LifecycleEvents;
+    private recordC2ConnectivityUnavailable;
     private getC2EventSyncSummary;
     recordC2LifecycleEvent(input: {
         eventType: C2LiteEventType;
@@ -597,6 +618,12 @@ export declare class ConnectV1Service {
     }): Promise<AgentScanResult>;
     buildAgentReviewSnapshot(): AgentReviewSnapshot;
     connectAgent(selector: string): DetectedAgent;
+    resolveWebsiteAgentHandoff(handoffToken: string): Promise<WebsiteAgentHandoff>;
+    private syncWebsiteAgentConnectionEvent;
+    approveWebsiteAgentHandoff(input: {
+        handoffToken: string;
+        agentSelector: string;
+    }): Promise<WebsiteAgentHandoffApprovalResult>;
     registerObservedAgent(input: {
         agentName: string;
         agentType: AgentType;
@@ -720,7 +747,12 @@ export declare class ConnectV1Service {
     private isProcessAlive;
     getDaemonStatus(): DaemonStatus;
     markDaemonStarted(pid: number): DaemonStatus;
-    markDaemonStopped(lastError: string | null): DaemonStatus;
+    markDaemonStopped(lastError: string | null, options?: {
+        unclean?: boolean;
+        detectedAt?: string;
+        previousStartedAt?: string | null;
+        previousLastScanAt?: string | null;
+    }): DaemonStatus;
     recordDaemonScan(summary: DaemonScanSummary): DaemonStatus;
     recordDaemonError(lastError: string): DaemonStatus;
     getPulseSummary(): VitalityPulseSummary | null;

package/dist/v1/service.js CHANGED Viewed

@@ -26,6 +26,15 @@ const DEFAULT_BASE_URL = process.env.FORKIT_API_URL ?? process.env.FORKIT_BASE_U
 const AGENT_INACTIVE_GRACE_MS = 5 * 60 * 1000;
 const CONNECT_PRIVACY_SUMMARY = 'Forkit Connect uses metadata-only local status by default. Project-scoped vibe-code observation is explicit opt-in, records only tool metadata, and does not store prompts, outputs, logs, file contents, or traffic.';
 const MAX_RUNTIME_SIGNAL_QUEUE_ITEMS = 200;
+const AGENT_ACTIVITY_ADAPTER_BY_SIGNATURE = Object.freeze({
+    antigravity: 'antigravity_v1',
+    claude: 'claude_v1',
+    'claude-code': 'claude_v1',
+    codex: 'codex_v1',
+    'codex-cli': 'codex_v1',
+    cursor: 'cursor_v1',
+    'vscode-agent': 'vscode_v1',
+});
 /** Max events flushed per daemon cycle — prevents thundering-herd on large queues. */
 const C2_SYNC_BATCH_SIZE = 50;
 /** Cooldown seconds after a rate-limit (429) or unavailability (503) response. */
@@ -52,9 +61,54 @@ const SMART_INBOX_CONFIDENCE_PRIORITY = {
     low: 2,
 };
 const SMART_INBOX_FRESH_MAX_AGE_MS = 45 * 1000;
+const C2_RUNTIME_SIGNAL_SENSITIVE_METADATA_PATTERNS = [
+    /prompt(?!_?tokens?$)/i,
+    /message/i,
+    /conversation/i,
+    /transcript/i,
+    /chat/i,
+    /log(s|_?text|_?content)?$/i,
+    /secret/i,
+    /password/i,
+    /api[_-]?key/i,
+    /token(?!s?($|_?(count|in|out|total|usage)$)|Usage$)/i,
+    /authorization/i,
+    /cookie/i,
+    /private[_-]?key/i,
+    /credential/i,
+    /email/i,
+    /phone/i,
+    /ssn/i,
+    /address/i,
+    /file[_-]?(content|body|text|data)/i,
+    /model[_-]?(weight|weights|binary|blob)/i,
+    /dataset[_-]?(row|rows|sample|content|record)/i,
+];
 function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
+function isSensitiveC2RuntimeSignalMetadataKey(key) {
+    return C2_RUNTIME_SIGNAL_SENSITIVE_METADATA_PATTERNS.some((pattern) => pattern.test(key));
+}
+function sanitizeC2RuntimeSignalMetadataValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => sanitizeC2RuntimeSignalMetadataValue(item));
+    }
+    if (!isRecord(value)) {
+        return value;
+    }
+    return sanitizeC2RuntimeSignalMetadata(value);
+}
+function sanitizeC2RuntimeSignalMetadata(metadata) {
+    const safeMetadata = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        if (isSensitiveC2RuntimeSignalMetadataKey(key)) {
+            continue;
+        }
+        safeMetadata[key] = sanitizeC2RuntimeSignalMetadataValue(value);
+    }
+    return safeMetadata;
+}
 function extractApiErrorCode(body) {
     if (!isRecord(body))
         return null;
@@ -2854,6 +2908,51 @@ class ConnectV1Service {
         })
             .at(0);
     }
+    getOperationalPassportContext(state) {
+        const normalize = (value) => typeof value === 'string' && value.trim() ? value.trim() : null;
+        const agent = [...state.detected_agents]
+            .filter((item) => normalize(item.metadata?.passport_gaid))
+            .sort((left, right) => {
+            const connectedDelta = Number(right.status === 'connected') - Number(left.status === 'connected');
+            if (connectedDelta !== 0)
+                return connectedDelta;
+            return String(right.last_seen_at || '').localeCompare(String(left.last_seen_at || ''));
+        })
+            .at(0);
+        if (agent) {
+            return {
+                passportGaid: normalize(agent.metadata?.passport_gaid),
+                workspaceId: normalize(agent.metadata?.workspace_id),
+                projectId: normalize(agent.metadata?.project_id),
+            };
+        }
+        const binding = this.getPrimaryBoundBinding(state);
+        return {
+            passportGaid: normalize(binding?.gaid),
+            workspaceId: normalize(binding?.workspaceId) ?? normalize(state.workspace_binding.workspaceId),
+            projectId: normalize(binding?.projectId) ?? normalize(state.project_binding.projectId),
+        };
+    }
+    recordAgentConnectionFault(input) {
+        const alreadyRecorded = this.stateStore.readState().c2_events.some((event) => (event.event_type === input.eventType
+            && event.passport_gaid === input.passportGaid
+            && event.metadata?.agent_id === input.agent.agent_id
+            && event.metadata?.failure_stage === input.metadata.failure_stage));
+        if (alreadyRecorded)
+            return;
+        this.recordC2LifecycleEvent({
+            eventType: input.eventType,
+            passportGaid: input.passportGaid,
+            workspaceId: input.workspaceId,
+            projectId: input.projectId,
+            metadata: {
+                agent_id: input.agent.agent_id,
+                agent_name: input.agent.agent_name,
+                agent_type: input.agent.agent_type,
+                ...input.metadata,
+            },
+        });
+    }
     setRuntimeSignalApiKeyForGaid(gaid, apiKey) {
         if (!gaid || !apiKey)
             return null;
@@ -3191,6 +3290,27 @@ class ConnectV1Service {
             });
         }
     }
+    recordC2ConnectivityUnavailable(event, reasonCode) {
+        const state = this.stateStore.readState();
+        if (state.c2_offline_since)
+            return;
+        const offlineSince = nowIso();
+        this.stateStore.updateC2ConnectivityStatus(offlineSince, state.last_c2_restored_at);
+        this.recordC2LifecycleEvent({
+            eventType: 'connect_sync_offline',
+            occurredAt: offlineSince,
+            passportGaid: event.passport_gaid,
+            workspaceId: event.workspace_id,
+            projectId: event.project_id,
+            metadata: {
+                period_kind: 'connectivity_unavailable',
+                offline_since: offlineSince,
+                detected_at: offlineSince,
+                reason_code: reasonCode,
+                evidence: 'observed_sync_failure',
+            },
+        });
+    }
     getC2EventSyncSummary(state) {
         return state.c2_events.reduce((summary, event) => {
             if (event.sync_state === 'synced') {
@@ -3622,10 +3742,11 @@ class ConnectV1Service {
             process_signature_hash: processSignatureHash,
             detected_at: input.existing?.detected_at ?? input.detectedAt,
             last_seen_at: input.detectedAt,
-            status: isConnectSelf || input.existing?.status === 'connected' ? 'connected' : 'detected',
+            status: isConnectSelf || existingPermanent ? 'connected' : 'detected',
             persistence,
             discovery_sources: [...new Set([...(input.existing?.discovery_sources ?? []), input.discoverySource])],
             metadata: {
+                ...(input.existing?.metadata ?? {}),
                 executable_name: input.candidate.executable_name,
                 signature: input.candidate.signature,
                 persistence,
@@ -3642,12 +3763,29 @@ class ConnectV1Service {
         };
     }
     queueAgentC2Event(agent, eventType, metadata = {}, occurredAt) {
+        const passportGaid = typeof metadata.passport_gaid === 'string' && metadata.passport_gaid.trim()
+            ? metadata.passport_gaid.trim()
+            : typeof agent.metadata?.passport_gaid === 'string' && agent.metadata.passport_gaid.trim()
+                ? agent.metadata.passport_gaid.trim()
+                : null;
+        const state = this.stateStore.readState();
+        const workspaceId = typeof metadata.workspace_id === 'string' && metadata.workspace_id.trim()
+            ? metadata.workspace_id.trim()
+            : typeof agent.metadata?.workspace_id === 'string' && agent.metadata.workspace_id.trim()
+                ? agent.metadata.workspace_id.trim()
+                : state.workspace_binding.workspaceId;
+        const projectId = typeof metadata.project_id === 'string' && metadata.project_id.trim()
+            ? metadata.project_id.trim()
+            : typeof agent.metadata?.project_id === 'string' && agent.metadata.project_id.trim()
+                ? agent.metadata.project_id.trim()
+                : state.project_binding.projectId;
         const eventInput = {
             eventType,
+            passportGaid,
             runtimeGaid: typeof metadata.runtime_gaid === 'string' ? metadata.runtime_gaid : null,
             modelName: null,
-            workspaceId: this.stateStore.readState().workspace_binding.workspaceId,
-            projectId: this.stateStore.readState().project_binding.projectId,
+            workspaceId,
+            projectId,
             metadata: {
                 agent_id: agent.agent_id,
                 agent_name: agent.agent_name,
@@ -3706,6 +3844,19 @@ class ConnectV1Service {
             byId.set(nextAgent.agent_id, nextAgent);
             if (existing) {
                 knownAgents += 1;
+                if (existing.status === 'inactive' && nextAgent.status === 'connected') {
+                    this.stateStore.addEvidenceEvent({
+                        type: 'agent_connected',
+                        details: {
+                            agent_id: nextAgent.agent_id,
+                            agent_name: nextAgent.agent_name,
+                            source: 'process_reappeared',
+                        },
+                    });
+                    this.queueAgentC2Event(nextAgent, 'connect_agent_started', {
+                        observation: 'process_reappeared',
+                    }, detectedAt);
+                }
             }
             else {
                 newAgents += 1;
@@ -3838,6 +3989,234 @@ class ConnectV1Service {
         this.queueAgentC2Event(nextAgent, 'connect_agent_connected', {}, updatedAt);
         return nextAgent;
     }
+    async resolveWebsiteAgentHandoff(handoffToken) {
+        const token = String(handoffToken || '').trim();
+        if (!token)
+            throw new Error('AGENT_HANDOFF_INVALID');
+        if (!this.hasSessionRef())
+            throw new Error('AGENT_HANDOFF_SIGN_IN_REQUIRED');
+        const result = await this.getApiClient(this.stateStore.readState()).resolveAgentHandoff(token);
+        if (!result.ok || !isRecord(result.body)) {
+            const code = this.extractBackendErrorCode(result.body);
+            if (result.status === 401)
+                throw new Error(code || 'AGENT_HANDOFF_SIGN_IN_REQUIRED');
+            throw new Error(code || `AGENT_HANDOFF_RESOLVE_FAILED:${result.status}`);
+        }
+        const passport = isRecord(result.body.passport) ? result.body.passport : null;
+        const protocol = normalizeDisplayText(result.body.protocol);
+        const expiresAt = normalizeDisplayText(result.body.expiresAt);
+        const gaid = normalizeDisplayText(passport?.gaid);
+        const name = normalizeDisplayText(passport?.name);
+        const passportType = normalizeDisplayText(passport?.passportType)?.toLowerCase();
+        if (protocol !== 'agent-handoff.v1' || !expiresAt || !gaid || !name || passportType !== 'agent') {
+            throw new Error('AGENT_HANDOFF_RESPONSE_INVALID');
+        }
+        return {
+            protocol: 'agent-handoff.v1',
+            expiresAt,
+            passport: {
+                gaid,
+                name,
+                passportType: 'agent',
+                workspaceId: normalizeDisplayText(passport?.workspaceId),
+                projectId: normalizeDisplayText(passport?.projectId),
+            },
+        };
+    }
+    async syncWebsiteAgentConnectionEvent(gaid, apiKey) {
+        const state = this.stateStore.readState();
+        const event = [...state.c2_events]
+            .reverse()
+            .find((item) => item.passport_gaid === gaid && item.event_type === 'connect_agent_connection_verified');
+        if (!event)
+            return { confirmed: false, pending: false };
+        if (event.sync_state === 'synced')
+            return { confirmed: true, pending: false };
+        try {
+            const result = await this.getApiClientWithSessionToken(apiKey).pushRuntimeSignalEvent(this.buildC2RuntimeSignalPayload(event, apiKey, null));
+            if (!result.ok) {
+                const error = `c2_sync_${result.status}`;
+                if (result.status === 429 || (result.status >= 500 && result.status <= 599)) {
+                    this.stateStore.markC2EventRetryable(event.event_id, error);
+                    if (result.status >= 500) {
+                        this.recordC2ConnectivityUnavailable(event, error);
+                    }
+                }
+                else {
+                    this.stateStore.markC2EventFailed(event.event_id, error);
+                }
+                return { confirmed: false, pending: true };
+            }
+            this.stateStore.markC2EventSynced(event.event_id);
+            this.stateStore.addEvidenceEvent({
+                type: 'runtimeSignal_synced',
+                details: {
+                    eventId: event.event_id,
+                    eventType: event.event_type,
+                    source: 'website_agent_handoff',
+                    status: result.status,
+                    gaid,
+                },
+            });
+            return { confirmed: true, pending: false };
+        }
+        catch (error) {
+            this.stateStore.markC2EventRetryable(event.event_id, error instanceof Error ? error.message : 'c2_sync_failed');
+            this.recordC2ConnectivityUnavailable(event, 'c2_network_unavailable');
+            return { confirmed: false, pending: true };
+        }
+    }
+    async approveWebsiteAgentHandoff(input) {
+        const handoff = await this.resolveWebsiteAgentHandoff(input.handoffToken);
+        const state = this.stateStore.readState();
+        const agent = this.findAgentByIdOrName(state, input.agentSelector);
+        if (!agent || agent.metadata?.signature === 'forkit-connect-desktop') {
+            throw new Error('AGENT_NOT_FOUND');
+        }
+        const existingGaid = normalizeDisplayText(agent.metadata?.passport_gaid);
+        if (existingGaid && existingGaid !== handoff.passport.gaid) {
+            throw new Error('AGENT_ALREADY_CONNECTED_TO_ANOTHER_PASSPORT');
+        }
+        const alreadyConnected = existingGaid === handoff.passport.gaid && this.hasRuntimeSignalKey(handoff.passport.gaid);
+        let rawKey = alreadyConnected
+            ? this.credentialStore.getRuntimeSignalApiKey(handoff.passport.gaid)
+            : null;
+        let keyRef = normalizeDisplayText(agent.metadata?.runtime_signal_key_ref);
+        if (!alreadyConnected) {
+            const secureStorage = this.getCredentialStoreStatus();
+            if (!secureStorage.available || secureStorage.plaintextFallbackActive) {
+                this.recordAgentConnectionFault({
+                    eventType: 'connect_secure_storage_failed',
+                    agent,
+                    passportGaid: handoff.passport.gaid,
+                    workspaceId: handoff.passport.workspaceId,
+                    projectId: handoff.passport.projectId,
+                    metadata: {
+                        failure_stage: 'preflight',
+                        reason_code: secureStorage.plaintextFallbackActive
+                            ? 'plaintext_fallback_not_allowed'
+                            : 'secure_storage_unavailable',
+                        storage_backend: secureStorage.backend,
+                        credential_persisted: false,
+                    },
+                });
+                throw new Error('SECURE_STORAGE_REQUIRED');
+            }
+            const keyResult = await this.getApiClient(this.stateStore.readState()).createPassportApiKey(handoff.passport.gaid, `Forkit Connect · ${agent.agent_name}`.slice(0, 100));
+            if (!keyResult.ok || !isRecord(keyResult.body)) {
+                throw new Error(this.extractBackendErrorCode(keyResult.body) || `AGENT_KEY_PROVISION_FAILED:${keyResult.status}`);
+            }
+            rawKey = normalizeDisplayText(keyResult.body.rawKey);
+            const keyId = normalizeDisplayText(keyResult.body.keyId);
+            if (!rawKey || !keyId)
+                throw new Error('AGENT_KEY_RESPONSE_INVALID');
+            try {
+                const credential = this.setRuntimeSignalApiKeyForGaid(handoff.passport.gaid, rawKey);
+                keyRef = credential?.credentialRef ?? null;
+            }
+            catch {
+                let registryKeyRevocationConfirmed = false;
+                try {
+                    const revocation = await this.getApiClient(this.stateStore.readState()).revokePassportApiKey(handoff.passport.gaid, keyId);
+                    registryKeyRevocationConfirmed = revocation.ok;
+                }
+                catch {
+                    // The original secure-storage failure is the actionable local error.
+                    // Registry-side key expiry/revocation remains independently auditable.
+                }
+                this.recordAgentConnectionFault({
+                    eventType: 'connect_secure_storage_failed',
+                    agent,
+                    passportGaid: handoff.passport.gaid,
+                    workspaceId: handoff.passport.workspaceId,
+                    projectId: handoff.passport.projectId,
+                    metadata: {
+                        failure_stage: 'credential_write',
+                        reason_code: 'secure_storage_write_failed',
+                        storage_backend: secureStorage.backend,
+                        credential_persisted: false,
+                        registry_key_revocation_confirmed: registryKeyRevocationConfirmed,
+                    },
+                });
+                throw new Error('SECURE_STORAGE_WRITE_FAILED');
+            }
+        }
+        const approvedAt = nowIso();
+        const agentSignature = normalizeDisplayText(agent.metadata?.signature)?.toLowerCase() ?? null;
+        const activityAdapter = agentSignature ? AGENT_ACTIVITY_ADAPTER_BY_SIGNATURE[agentSignature] ?? null : null;
+        const connectedAgent = {
+            ...agent,
+            status: 'connected',
+            persistence: 'permanent',
+            last_seen_at: approvedAt,
+            discovery_sources: [...new Set([...agent.discovery_sources, 'manual_connect'])],
+            metadata: {
+                ...agent.metadata,
+                passport_gaid: handoff.passport.gaid,
+                passport_name: handoff.passport.name,
+                workspace_id: handoff.passport.workspaceId,
+                project_id: handoff.passport.projectId,
+                tracking_status: 'connected',
+                activity_adapter: activityAdapter,
+                activity_observation_level: activityAdapter ? 'detailed' : 'presence_only',
+                website_handoff_approved_at: approvedAt,
+                runtime_signal_key_ref: keyRef,
+            },
+        };
+        this.stateStore.upsertDetectedAgent(connectedAgent);
+        let verificationEvent = [...this.stateStore.readState().c2_events]
+            .reverse()
+            .find((item) => item.passport_gaid === handoff.passport.gaid && item.event_type === 'connect_agent_connection_verified');
+        if (!verificationEvent) {
+            verificationEvent = this.recordC2LifecycleEvent({
+                eventType: 'connect_agent_connection_verified',
+                occurredAt: approvedAt,
+                passportGaid: handoff.passport.gaid,
+                workspaceId: handoff.passport.workspaceId,
+                projectId: handoff.passport.projectId,
+                metadata: {
+                    agent_id: connectedAgent.agent_id,
+                    agent_name: connectedAgent.agent_name,
+                    agent_type: connectedAgent.agent_type,
+                    process_signature_hash: connectedAgent.process_signature_hash,
+                    source: 'website_agent_handoff',
+                    safe_metadata_only: true,
+                },
+            });
+            this.stateStore.addEvidenceEvent({
+                type: 'agent_connected',
+                details: {
+                    agent_id: connectedAgent.agent_id,
+                    agent_name: connectedAgent.agent_name,
+                    gaid: handoff.passport.gaid,
+                    source: 'website_agent_handoff',
+                },
+            });
+        }
+        if (!activityAdapter) {
+            this.recordAgentConnectionFault({
+                eventType: 'connect_agent_adapter_unavailable',
+                agent: connectedAgent,
+                passportGaid: handoff.passport.gaid,
+                workspaceId: handoff.passport.workspaceId,
+                projectId: handoff.passport.projectId,
+                metadata: {
+                    adapter_status: 'unavailable',
+                    reason_code: 'no_supported_activity_adapter',
+                    observation_level: 'presence_only',
+                    detected_signature: agentSignature ?? 'unknown',
+                },
+            });
+        }
+        const sync = await this.syncWebsiteAgentConnectionEvent(handoff.passport.gaid, rawKey);
+        return {
+            action: alreadyConnected ? 'already_connected' : 'connected',
+            agent: connectedAgent,
+            passport: handoff.passport,
+            activityConfirmed: sync.confirmed,
+            syncPending: sync.pending,
+        };
+    }
     async registerObservedAgent(input) {
         const candidate = this.buildObservedAgentCandidate(input);
         const scanResult = await this.scanAgents({
@@ -6921,34 +7300,35 @@ class ConnectV1Service {
         return nextSession;
     }
     buildC2RuntimeSignalPayload(event, apiKey, scope) {
+        const metadata = sanitizeC2RuntimeSignalMetadata({
+            client_event_id: event.event_id, // traceable but excluded from server idempotency hash
+            runtime_gaid: event.runtime_gaid,
+            runtime_name: event.runtime_name,
+            runtime_type: event.runtime_type,
+            model_name: event.model_name,
+            discoveryHash: event.discovery_hash,
+            registrationKey: event.registration_key,
+            passportGaid: event.passport_gaid,
+            pulse_status: event.pulse_status,
+            connection_classification: event.connection_classification,
+            daemon_running: event.daemon_running,
+            shadow_candidate_reason: event.shadow_candidate_reason,
+            ...event.metadata,
+            binding_id: scope?.bindingId ?? null,
+            connect_device_id: scope?.connectDeviceId ?? null,
+            workspaceId: scope?.workspaceId ?? event.workspace_id ?? null,
+            projectId: scope?.projectId ?? event.project_id ?? null,
+            workspace_id: scope?.workspaceId ?? event.workspace_id ?? null,
+            project_id: scope?.projectId ?? event.project_id ?? null,
+            evidence_type: 'observed_runtime_session',
+        });
         return {
             gaid: event.passport_gaid,
             apiKey,
             binding_id: scope?.bindingId ?? null,
             eventType: event.event_type,
             timestamp: event.occurred_at,
-            metadata: {
-                client_event_id: event.event_id, // traceable but excluded from server idempotency hash
-                runtime_gaid: event.runtime_gaid,
-                runtime_name: event.runtime_name,
-                runtime_type: event.runtime_type,
-                model_name: event.model_name,
-                discoveryHash: event.discovery_hash,
-                registrationKey: event.registration_key,
-                passportGaid: event.passport_gaid,
-                pulse_status: event.pulse_status,
-                connection_classification: event.connection_classification,
-                daemon_running: event.daemon_running,
-                shadow_candidate_reason: event.shadow_candidate_reason,
-                ...event.metadata,
-                binding_id: scope?.bindingId ?? null,
-                connect_device_id: scope?.connectDeviceId ?? null,
-                workspaceId: scope?.workspaceId ?? event.workspace_id ?? null,
-                projectId: scope?.projectId ?? event.project_id ?? null,
-                workspace_id: scope?.workspaceId ?? event.workspace_id ?? null,
-                project_id: scope?.projectId ?? event.project_id ?? null,
-                evidence_type: 'observed_runtime_session',
-            },
+            metadata,
         };
     }
     runtimeRecommendedAction(runtimePassport) {
@@ -7087,6 +7467,7 @@ class ConnectV1Service {
         let succeeded = 0;
         let failed = 0;
         let firstError = null;
+        const connectivityFailure = { value: null };
         // When the server signals rate-limit (429) we record the retry-after deadline and
         // stop sending for this cycle to avoid burning through the remaining budget.
         let rateLimitedUntilMs = null;
@@ -7154,7 +7535,13 @@ class ConnectV1Service {
                         source: 'runtimeSignal',
                     });
                     const error = `c2_sync_${result.status}`;
-                    this.stateStore.markC2EventFailed(event.event_id, error);
+                    if (result.status >= 500 && result.status <= 599) {
+                        this.stateStore.markC2EventRetryable(event.event_id, error);
+                        connectivityFailure.value ??= { event, reasonCode: error };
+                    }
+                    else {
+                        this.stateStore.markC2EventFailed(event.event_id, error);
+                    }
                     firstError ??= error;
                     failed += 1;
                     if (halt) {
@@ -7177,7 +7564,8 @@ class ConnectV1Service {
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : 'c2_sync_failed';
-                this.stateStore.markC2EventFailed(event.event_id, message);
+                this.stateStore.markC2EventRetryable(event.event_id, message);
+                connectivityFailure.value ??= { event, reasonCode: 'c2_network_unavailable' };
                 firstError ??= message;
                 failed += 1;
             }
@@ -7228,6 +7616,35 @@ class ConnectV1Service {
         const lastSyncAt = attempted > 0 ? nowIso() : state.last_c2_sync_at;
         const lastSyncError = firstError;
         this.stateStore.updateC2SyncStatus(lastSyncAt, lastSyncError);
+        const connectivityState = this.stateStore.readState();
+        if (connectivityFailure.value && !connectivityState.c2_offline_since) {
+            const failure = connectivityFailure.value;
+            this.recordC2ConnectivityUnavailable(failure.event, failure.reasonCode);
+        }
+        else if (!connectivityFailure.value && connectivityState.c2_offline_since && succeeded > 0) {
+            const restoredAt = nowIso();
+            const offlineSince = connectivityState.c2_offline_since;
+            const durationSeconds = Math.max(0, Math.round((Date.parse(restoredAt) - Date.parse(offlineSince)) / 1000));
+            const offlineEvent = [...connectivityState.c2_events]
+                .reverse()
+                .find((event) => event.event_type === 'connect_sync_offline');
+            const fallbackContext = this.getOperationalPassportContext(connectivityState);
+            this.stateStore.updateC2ConnectivityStatus(null, restoredAt);
+            this.recordC2LifecycleEvent({
+                eventType: 'connect_sync_restored',
+                occurredAt: restoredAt,
+                passportGaid: offlineEvent?.passport_gaid ?? fallbackContext.passportGaid,
+                workspaceId: offlineEvent?.workspace_id ?? fallbackContext.workspaceId,
+                projectId: offlineEvent?.project_id ?? fallbackContext.projectId,
+                metadata: {
+                    period_kind: 'connectivity_unavailable',
+                    offline_since: offlineSince,
+                    restored_at: restoredAt,
+                    duration_seconds: durationSeconds,
+                    evidence: 'successful_sync',
+                },
+            });
+        }
         const finalState = this.stateStore.readState();
         const finalSummary = this.getC2EventSyncSummary(finalState);
         return {
@@ -7507,7 +7924,12 @@ class ConnectV1Service {
         const state = this.stateStore.readState();
         const daemonStatus = state.daemon_status;
         if (daemonStatus.daemon_running && daemonStatus.daemon_pid && !this.isProcessAlive(daemonStatus.daemon_pid)) {
-            return this.markDaemonStopped(daemonStatus.last_error ?? 'daemon_process_missing');
+            return this.markDaemonStopped(daemonStatus.last_error ?? 'daemon_process_missing', {
+                unclean: true,
+                detectedAt: nowIso(),
+                previousStartedAt: daemonStatus.started_at,
+                previousLastScanAt: daemonStatus.last_scan_at,
+            });
         }
         return daemonStatus;
     }
@@ -7519,13 +7941,13 @@ class ConnectV1Service {
             started_at: nowIso(),
             last_error: null,
         }).daemon_status;
-        const boundBinding = this.getPrimaryBoundBinding(state);
+        const context = this.getOperationalPassportContext(state);
         this.recordC2LifecycleEvent({
             eventType: 'connect_daemon_started',
             occurredAt: nextStatus.started_at ?? nowIso(),
-            passportGaid: boundBinding?.gaid ?? null,
-            workspaceId: state.workspace_binding.workspaceId,
-            projectId: state.project_binding.projectId,
+            passportGaid: context.passportGaid,
+            workspaceId: context.workspaceId,
+            projectId: context.projectId,
             daemonRunning: true,
             metadata: {
                 daemon_pid: pid,
@@ -7533,24 +7955,48 @@ class ConnectV1Service {
         });
         return nextStatus;
     }
-    markDaemonStopped(lastError) {
+    markDaemonStopped(lastError, options) {
         const state = this.stateStore.readState();
+        const detectedAt = options?.detectedAt ?? nowIso();
         const nextStatus = this.stateStore.updateDaemonStatus({
             daemon_running: false,
             daemon_pid: null,
             last_error: lastError,
         }).daemon_status;
-        const boundBinding = this.getPrimaryBoundBinding(state);
+        const context = this.getOperationalPassportContext(state);
         this.recordC2LifecycleEvent({
             eventType: 'connect_daemon_stopped',
-            passportGaid: boundBinding?.gaid ?? null,
-            workspaceId: state.workspace_binding.workspaceId,
-            projectId: state.project_binding.projectId,
+            occurredAt: detectedAt,
+            passportGaid: context.passportGaid,
+            workspaceId: context.workspaceId,
+            projectId: context.projectId,
             daemonRunning: false,
             metadata: {
                 last_error: lastError,
+                stop_classification: options?.unclean ? 'unclean' : 'clean',
             },
         });
+        if (options?.unclean) {
+            const gapStartedAt = options.previousLastScanAt ?? options.previousStartedAt ?? detectedAt;
+            const parsedDuration = Math.round((Date.parse(detectedAt) - Date.parse(gapStartedAt)) / 1000);
+            this.recordC2LifecycleEvent({
+                eventType: 'connect_activity_gap_detected',
+                occurredAt: detectedAt,
+                passportGaid: context.passportGaid,
+                workspaceId: context.workspaceId,
+                projectId: context.projectId,
+                daemonRunning: false,
+                metadata: {
+                    gap_kind: 'unclean_shutdown',
+                    gap_started_at: gapStartedAt,
+                    gap_detected_at: detectedAt,
+                    gap_duration_seconds: Number.isFinite(parsedDuration) ? Math.max(0, parsedDuration) : 0,
+                    confidence: 'inferred',
+                    reason_code: lastError ?? 'daemon_process_missing',
+                    data_loss_confirmed: false,
+                },
+            });
+        }
         return nextStatus;
     }
     recordDaemonScan(summary) {
@@ -8934,6 +9380,26 @@ class ConnectV1Service {
                 queue_limit: MAX_RUNTIME_SIGNAL_QUEUE_ITEMS,
             },
         });
+        if (trimmed > 0) {
+            const overflowAlreadyPending = this.stateStore.readState().c2_events.some((event) => (event.event_type === 'connect_queue_overflow'
+                && event.passport_gaid === gaid
+                && event.sync_state === 'pending'
+                && event.metadata?.overflow_kind === 'runtime_signal_local_queue_capacity'));
+            if (!overflowAlreadyPending) {
+                this.recordC2LifecycleEvent({
+                    eventType: 'connect_queue_overflow',
+                    passportGaid: gaid,
+                    workspaceId: runtimeScope?.workspaceId ?? state.workspace_binding.workspaceId,
+                    projectId: runtimeScope?.projectId ?? state.project_binding.projectId,
+                    metadata: {
+                        overflow_kind: 'runtime_signal_local_queue_capacity',
+                        dropped_event_count: trimmed,
+                        queue_limit: MAX_RUNTIME_SIGNAL_QUEUE_ITEMS,
+                        data_loss_confirmed: true,
+                    },
+                });
+            }
+        }
         return queueItem.id;
     }
     queueConfiguredHeartbeatRuntimeSignal(gaid) {

package/dist/v1/state.d.ts CHANGED Viewed

@@ -33,6 +33,7 @@ export declare class LocalStateStore {
     pruneRedundantPendingC2Events(): number;
     backfillMissingGaidOnPendingC2Events(gaid: string): number;
     updateC2SyncStatus(lastSyncAt: string | null, lastSyncError: string | null): ConnectState;
+    updateC2ConnectivityStatus(offlineSince: string | null, restoredAt: string | null): ConnectState;
     /**
      * Backfill pending events that have no passport_gaid with the supplied gaid.
      * Events recorded before a model was bound lack a GAID; once binding is
@@ -42,6 +43,7 @@ export declare class LocalStateStore {
     backfillC2EventsWithGaid(gaid: string): number;
     markC2EventSynced(eventId: string): ConnectState;
     markC2EventFailed(eventId: string, errorMessage: string): ConnectState;
+    markC2EventRetryable(eventId: string, errorMessage: string): ConnectState;
     discardC2Event(eventId: string, errorMessage: string): ConnectState;
     updatePulseState(summary: VitalityPulseSummary | null, lastError: string | null, pulseEvents?: Array<Omit<VitalityPulseEvent, 'event_id'>>): ConnectState;
     upsertDetectedRuntime(runtime: DetectedRuntime): ConnectState;

package/dist/v1/state.js CHANGED Viewed

@@ -54,6 +54,8 @@ const STATE_SECTION_NAMES = [
     'daemon_status',
     'last_c2_sync_at',
     'last_c2_sync_error',
+    'c2_offline_since',
+    'last_c2_restored_at',
     'c2_events',
     'last_pulse_at',
     'last_pulse_summary',
@@ -401,6 +403,8 @@ function normalizeState(parsed) {
         daemon_status: normalizeDaemonStatus(value.daemon_status),
         last_c2_sync_at: typeof value.last_c2_sync_at === 'string' ? value.last_c2_sync_at : null,
         last_c2_sync_error: typeof value.last_c2_sync_error === 'string' ? value.last_c2_sync_error : null,
+        c2_offline_since: typeof value.c2_offline_since === 'string' ? value.c2_offline_since : null,
+        last_c2_restored_at: typeof value.last_c2_restored_at === 'string' ? value.last_c2_restored_at : null,
         c2_events: Array.isArray(value.c2_events) ? value.c2_events : [],
         last_pulse_at: typeof value.last_pulse_at === 'string' ? value.last_pulse_at : null,
         last_pulse_summary: value.last_pulse_summary && typeof value.last_pulse_summary === 'object'
@@ -468,6 +472,8 @@ function buildInitialState() {
         daemon_status: buildDefaultDaemonStatus(),
         last_c2_sync_at: null,
         last_c2_sync_error: null,
+        c2_offline_since: null,
+        last_c2_restored_at: null,
         c2_events: [],
         last_pulse_at: null,
         last_pulse_summary: null,
@@ -644,7 +650,55 @@ class LocalStateStore {
             const cutoff = Date.now() - C2_SYNCED_EVICTION_AGE_MS;
             state.c2_events = state.c2_events.filter((event) => event.sync_state !== 'synced' || !event.synced_at || new Date(event.synced_at).getTime() > cutoff);
             if (state.c2_events.length > C2_EVENT_RETENTION_LIMIT) {
-                state.c2_events = state.c2_events.slice(-C2_EVENT_RETENTION_LIMIT);
+                const existingMarker = state.c2_events.find((event) => (event.event_type === 'connect_queue_overflow'
+                    && event.sync_state === 'pending'
+                    && event.metadata?.overflow_kind === 'c2_lifecycle_queue_capacity'));
+                const requiredDrops = state.c2_events.length - C2_EVENT_RETENTION_LIMIT + (existingMarker ? 0 : 1);
+                const droppedIds = new Set();
+                for (const event of state.c2_events) {
+                    if (droppedIds.size >= requiredDrops)
+                        break;
+                    if (event.event_id === existingMarker?.event_id)
+                        continue;
+                    droppedIds.add(event.event_id);
+                }
+                state.c2_events = state.c2_events.filter((event) => !droppedIds.has(event.event_id));
+                const detectedAt = nowIso();
+                const scopeEvent = [...events, ...state.c2_events]
+                    .reverse()
+                    .find((event) => Boolean(event.passport_gaid));
+                const previousDropped = Number(existingMarker?.metadata?.dropped_event_count ?? 0);
+                const marker = {
+                    event_id: existingMarker?.event_id ?? (0, node_crypto_1.randomUUID)(),
+                    event_type: 'connect_queue_overflow',
+                    occurred_at: detectedAt,
+                    runtime_gaid: null,
+                    runtime_name: null,
+                    runtime_type: null,
+                    model_name: null,
+                    discovery_hash: null,
+                    registration_key: null,
+                    passport_gaid: scopeEvent?.passport_gaid ?? null,
+                    workspace_id: scopeEvent?.workspace_id ?? null,
+                    project_id: scopeEvent?.project_id ?? null,
+                    pulse_status: null,
+                    connection_classification: null,
+                    daemon_running: null,
+                    shadow_candidate_reason: null,
+                    metadata: {
+                        overflow_kind: 'c2_lifecycle_queue_capacity',
+                        dropped_event_count: previousDropped + requiredDrops,
+                        queue_limit: C2_EVENT_RETENTION_LIMIT,
+                        detected_at: detectedAt,
+                        data_loss_confirmed: true,
+                    },
+                    sync_state: 'pending',
+                    synced_at: null,
+                    last_error: null,
+                    retry_count: 0,
+                };
+                state.c2_events = state.c2_events.filter((event) => event.event_id !== marker.event_id);
+                state.c2_events.push(marker);
             }
         });
     }
@@ -703,6 +757,12 @@ class LocalStateStore {
             state.last_c2_sync_error = lastSyncError;
         });
     }
+    updateC2ConnectivityStatus(offlineSince, restoredAt) {
+        return this.mutateState((state) => {
+            state.c2_offline_since = offlineSince;
+            state.last_c2_restored_at = restoredAt;
+        });
+    }
     /**
      * Backfill pending events that have no passport_gaid with the supplied gaid.
      * Events recorded before a model was bound lack a GAID; once binding is
@@ -759,6 +819,22 @@ class LocalStateStore {
             };
         });
     }
+    markC2EventRetryable(eventId, errorMessage) {
+        return this.mutateState((state) => {
+            const index = state.c2_events.findIndex((event) => event.event_id === eventId);
+            if (index < 0)
+                return;
+            const current = state.c2_events[index];
+            if (!current)
+                return;
+            state.c2_events[index] = {
+                ...current,
+                sync_state: 'pending',
+                synced_at: null,
+                last_error: errorMessage,
+            };
+        });
+    }
     discardC2Event(eventId, errorMessage) {
         return this.mutateState((state) => {
             const index = state.c2_events.findIndex((event) => event.event_id === eventId);

package/dist/v1/types.d.ts CHANGED Viewed

@@ -29,7 +29,7 @@ export type NotificationSuggestedAction = 'open_inbox' | 'reconnect_account' | '
 export type C2SessionMode = 'active' | 'paused' | 'standby' | 'sleeping' | 'offline' | 'revoked';
 export type C2SessionLocalSyncState = 'observed' | 'ack_pending' | 'acknowledged' | 'credential_reconnect_needed';
 export type C2SessionControlSource = 'website' | 'backend_governor' | 'local';
-export type C2LiteEventType = 'connect_runtime_detected' | 'connect_model_detected' | 'connect_passport_draft_requested' | 'connect_passport_draft_created' | 'connect_passport_bound' | 'connect_runtime_bound_to_model' | 'connect_runtime_linked_to_agent' | 'connect_runtime_health_changed' | 'connect_daemon_started' | 'connect_daemon_stopped' | 'connect_runtime_active' | 'connect_runtime_unavailable' | 'connect_runtime_restored' | 'connect_pulse_green' | 'connect_pulse_amber' | 'connect_pulse_red' | 'connect_shadow_candidate_detected' | 'connect_training_initialized' | 'connect_training_started' | 'connect_fine_tuning_started' | 'connect_dataset_changed' | 'connect_metric_logged' | 'connect_model_version_created' | 'connect_artifact_ready' | 'connect_training_completed' | 'connect_agent_detected' | 'connect_agent_connected' | 'connect_agent_model_linked' | 'connect_agent_tool_observed' | 'connect_agent_tool_blocked' | 'connect_agent_tool_timed_out' | 'connect_agent_inactive' | 'connect_model_evolution_detected' | 'connect_model_evolution_archived' | 'connect_session_paused_acknowledged' | 'connect_session_resumed_acknowledged' | 'connect_session_access_revoked_acknowledged' | 'connect_passport_governor_paused_observed' | 'connect_passport_governor_revoked_observed' | 'connect_credential_invalid_observed' | 'connect_silent_model_change' | 'connect_model_drift_detected' | 'connect_hallucination_pattern' | 'connect_agent_drift_detected' | 'connect_prompt_injection_suspected' | 'connect_adversarial_influence_observed' | 'connect_runtime_signal_key_auto_provisioned' | 'connect_lifecycle_monitor_pass_completed';
+export type C2LiteEventType = 'connect_runtime_detected' | 'connect_model_detected' | 'connect_passport_draft_requested' | 'connect_passport_draft_created' | 'connect_passport_bound' | 'connect_runtime_bound_to_model' | 'connect_runtime_linked_to_agent' | 'connect_runtime_health_changed' | 'connect_daemon_started' | 'connect_daemon_stopped' | 'connect_sync_offline' | 'connect_sync_restored' | 'connect_activity_gap_detected' | 'connect_secure_storage_failed' | 'connect_queue_overflow' | 'connect_runtime_active' | 'connect_runtime_unavailable' | 'connect_runtime_restored' | 'connect_pulse_green' | 'connect_pulse_amber' | 'connect_pulse_red' | 'connect_shadow_candidate_detected' | 'connect_training_initialized' | 'connect_training_started' | 'connect_fine_tuning_started' | 'connect_dataset_changed' | 'connect_metric_logged' | 'connect_model_version_created' | 'connect_artifact_ready' | 'connect_training_completed' | 'connect_agent_detected' | 'connect_agent_connected' | 'connect_agent_connection_verified' | 'connect_agent_started' | 'connect_agent_adapter_unavailable' | 'connect_agent_model_linked' | 'connect_agent_tool_observed' | 'connect_agent_tool_blocked' | 'connect_agent_tool_timed_out' | 'connect_agent_inactive' | 'connect_model_evolution_detected' | 'connect_model_evolution_archived' | 'connect_session_paused_acknowledged' | 'connect_session_resumed_acknowledged' | 'connect_session_access_revoked_acknowledged' | 'connect_passport_governor_paused_observed' | 'connect_passport_governor_revoked_observed' | 'connect_credential_invalid_observed' | 'connect_silent_model_change' | 'connect_model_drift_detected' | 'connect_hallucination_pattern' | 'connect_agent_drift_detected' | 'connect_prompt_injection_suspected' | 'connect_adversarial_influence_observed' | 'connect_runtime_signal_key_auto_provisioned' | 'connect_lifecycle_monitor_pass_completed';
 export type C2LiteSyncState = 'pending' | 'synced' | 'dead_letter';
 export type PendingReviewKind = 'silent_model_change' | 'model_drift' | 'hallucination_pattern' | 'agent_drift' | 'prompt_injection' | 'adversarial_influence';
 export type PendingReviewStatus = 'pending' | 'confirmed' | 'dismissed' | 'auto_confirmed';
@@ -899,6 +899,8 @@ export interface ConnectState {
     daemon_status: DaemonStatus;
     last_c2_sync_at: string | null;
     last_c2_sync_error: string | null;
+    c2_offline_since: string | null;
+    last_c2_restored_at: string | null;
     c2_events: C2LifecycleEvent[];
     last_pulse_at: string | null;
     last_pulse_summary: VitalityPulseSummary | null;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "forkit-connect",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "Forkit Connect Local Engine - The Global AI Governance Fabric",
   "license": "MIT",
   "main": "dist/index.js",