@consiliency/agent-board-cli 1.27.1 → 1.29.0

package/claude-marketplace/plugins/agent-board/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-board",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "Message Board for Claude Code: the agent-board MCP server and the local wake hook that nudges an idle session when its inbox has unhandled items.",
   "author": {
     "name": "Consiliency"
@@ -10,7 +10,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@consiliency/agent-board-mcp@1.32.0",
+        "@consiliency/agent-board-mcp@1.33.0",
         "--harness",
         "claude"
       ]

package/dist/assets.json

@@ -1,6 +1,6 @@
 {
-  "mcpVersion": "1.32.0",
-  "piVersion": "0.4.2",
-  "opencodeVersion": "0.2.2",
-  "releaseTag": "v1.56.0"
+  "mcpVersion": "1.33.0",
+  "piVersion": "0.4.3",
+  "opencodeVersion": "0.2.3",
+  "releaseTag": "v1.58.0"
 }

package/dist/cli.d.ts

@@ -1,7 +1,8 @@
 import { Command } from "commander";
-import { createAgentBoardClient, type EnrollKeystore, type EnrollmentIntent, type FleetOnboardingIntent, type PendingEnrollmentStore, type OAuthFetchLike, type FetchLike, type AgentJoinDeployment, type AgentJoinInstructions, type DeviceAuthorizationPrompt, resolveCredentials } from "@consiliency/agent-board-client";
+import { createAgentBoardClient, type EnrollKeystore, type EnrollmentIntent, type FleetOnboardingIntent, type PendingEnrollmentStore, type OAuthFetchLike, type FetchLike, type AgentJoinDeployment, type AgentJoinInstructions, type DeviceAuthorizationPrompt, resolveCredentials, type MyBoardRequest } from "@consiliency/agent-board-client";
 import { type DoctorOptions, type DoctorReport } from "./doctor.js";
 import { type SetupEnroller, type SetupRunner } from "./setup.js";
+import { type SetupAllRunner } from "./setup_all.js";
 import { DevicePendingEnrollmentStore } from "./enroll_runtime.js";
 type JsonObject = Record<string, unknown>;
 export interface CliIo {
@@ -64,6 +65,7 @@ interface ClientLike {
     }>;
     revokeInviteLink(input: JsonObject): Promise<unknown>;
     redeemInviteLink(input: JsonObject): Promise<unknown>;
+    listMyBoardRequests(): Promise<MyBoardRequest[]>;
     listBoardMembers(input: JsonObject): Promise<unknown>;
     listBoardPendingMemberships(input: JsonObject): Promise<unknown>;
     resolveAgentHandle(input: JsonObject): Promise<unknown>;
@@ -333,13 +335,14 @@ export interface CredentialSelection {
  * for the same reason. Without it: `resolveCredentials(descriptor, env)`, exactly as before.
  */
 export declare function fileAwareCredentials(selection: CredentialSelection, env?: NodeJS.ProcessEnv): (descriptor?: Parameters<typeof resolveCredentials>[0]) => Promise<import("@consiliency/agent-board-client").ResolvedCredentials>;
-export declare function createProgram(client: ClientLike, io: CliIo, enrollment?: EnrollmentCommandRunner, doctor?: DoctorRunner, selection?: CredentialSelection, setup?: SetupRunner): Command;
+export declare function createProgram(client: ClientLike, io: CliIo, enrollment?: EnrollmentCommandRunner, doctor?: DoctorRunner, selection?: CredentialSelection, setup?: SetupRunner, setupAll?: SetupAllRunner): Command;
 export interface RunCliOptions {
     /** The env the default client's credential resolver reads. Default `process.env`. */
     env?: NodeJS.ProcessEnv;
     /** Extra options for the DEFAULT client (tests: a `dataSourceFactory`); never its resolver. */
     clientOptions?: Omit<NonNullable<Parameters<typeof createAgentBoardClient>[0]>, "resolveCredentials">;
     setup?: SetupRunner;
+    setupAll?: SetupAllRunner;
 }
 export declare function runCli(argv: string[], io?: CliIo, client?: ClientLike, enrollment?: EnrollmentCommandRunner, doctor?: DoctorRunner, options?: RunCliOptions): Promise<void>;
 export {};

package/dist/cli.js

@@ -3,9 +3,10 @@ import { createHash, randomUUID } from "node:crypto";
 import * as nodeFs from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { createAgentBoardClient, toOperationFailure, beginEnrollment, completeEnrollment, beginDeviceEnrollment, completeDeviceEnrollment, runEnrollment, runDeviceEnrollment, resolveEnrollmentDescriptor, EnrollmentDescriptorError, EnrollmentCommandError, resolveEnrollEndpoint, resolveEnrollSessionUrl, resolveEnrollPublishableKey, resolveJoinDeployment, buildFleetHarnessTemplate, finalizeFleetHarnessTemplate, normalizePublishableKeyFieldReference, normalizeFleetTupleValue, normalizeKeyReference, enrollCommitMarker, assertPresentationSafe, FLEET_TEMPLATE_FAILURE_MESSAGE, PROHIBITED_PRESENTATION_REMOVE_CLASS, buildAgentJoinInstructions, nodeFetchAdapter, buildEnrollKeystore, AUTHORED_CAUSE_CODES, codeProvenance, markAuthoredCode, assertIdentityHarness, identityFilePath, resolveHostSegment, identityConfigRoot, walkTrustedDirectory, IDENTITY_HARNESSES, CredentialResolutionError, readIdentityFile, resolveCredentials, } from "@consiliency/agent-board-client";
+import { createAgentBoardClient, toOperationFailure, beginEnrollment, completeEnrollment, beginDeviceEnrollment, completeDeviceEnrollment, runEnrollment, runDeviceEnrollment, resolveEnrollmentDescriptor, EnrollmentDescriptorError, EnrollmentCommandError, resolveEnrollEndpoint, resolveEnrollSessionUrl, resolveEnrollPublishableKey, resolveJoinDeployment, buildFleetHarnessTemplate, finalizeFleetHarnessTemplate, normalizePublishableKeyFieldReference, normalizeFleetTupleValue, normalizeKeyReference, enrollCommitMarker, assertPresentationSafe, FLEET_TEMPLATE_FAILURE_MESSAGE, PROHIBITED_PRESENTATION_REMOVE_CLASS, buildAgentJoinInstructions, nodeFetchAdapter, buildEnrollKeystore, AUTHORED_CAUSE_CODES, codeProvenance, markAuthoredCode, assertIdentityHarness, identityFilePath, resolveHostSegment, identityConfigRoot, walkTrustedDirectory, IDENTITY_HARNESSES, CredentialResolutionError, readIdentityFile, resolveCredentials, parseInviteInput, } from "@consiliency/agent-board-client";
 import { fileIdentityEnv, formatDoctorReport, runDoctor } from "./doctor.js";
 import { addSetupCommand, runSetup } from "./setup.js";
+import { runSetupAll, setupAllCommand } from "./setup_all.js";
 import { identityValuesFromEnrollment, resolveIdentityDeployment, writeIdentityFile, } from "./identity_writer.js";
 import { DevicePendingEnrollmentStore, FilePendingEnrollmentStore, FleetDeviceContinuationStore, makeBrowserOpener, prepareFleetRuntimeOutput, publishFinalizedFleetTemplate, } from "./enroll_runtime.js";
 function isRuntimeStatus(value) {
@@ -2900,7 +2901,12 @@ function renderDevicePrompt(prompt) {
     lines.push("");
     return `${lines.join("\n")}\n`;
 }
-/** Read a single-line auth code from a piped stdin (A5). Returns undefined on a TTY. */
+/**
+ * Read a single-line code from a piped stdin (A5), trimmed. Returns undefined on a TTY. Its callers
+ * are the OAuth authorization code (not an invite) and the fleet onboarding invite code, which
+ * IF-0-ONBOARD-2 keeps out of the invite parser (a fleet invite has no designated field). A room
+ * invite is read by `readInviteFromStdin` and parsed.
+ */
 async function readCodeFromStdin() {
     if (process.stdin.isTTY)
         return undefined;
@@ -2911,6 +2917,17 @@ async function readCodeFromStdin() {
     const text = Buffer.concat(chunks).toString("utf8").trim();
     return text.length > 0 ? text : undefined;
 }
+/** All of a piped stdin, unparsed (a room invite message is several lines). undefined on a TTY. */
+async function readInviteFromStdin() {
+    if (process.stdin.isTTY)
+        return undefined;
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString("utf8");
+    return text.trim().length > 0 ? text : undefined;
+}
 function addRoomsCommands(program, client, io) {
     const rooms = program
         .command("rooms")
@@ -3094,17 +3111,27 @@ function addRoomsCommands(program, client, io) {
         .description("Redeem an invite link by code, joining as the agent identity resolved from this host's env credentials. The code is a BEARER SECRET — prefer piping it on stdin.")
         .option("--code <code>", "the invite code (prefer stdin; argv leaks via /proc/<pid>/cmdline and shell history)")
         .action(async (o) => {
-        let code = o.code;
-        if (!code) {
-            code = await readCodeFromStdin();
-        }
-        if (!code) {
-            io.writeStderr("link-redeem needs an invite code: pipe it on stdin (e.g. `agent-board rooms link-redeem <<'MB_INVITE_CODE'` ... `MB_INVITE_CODE`) or pass --code (which leaks the bearer code via /proc and shell history).\n");
+        // IF-0-ONBOARD-2: the code, or the whole invite message on stdin, goes through the ONE
+        // shared parser, which reads only the designated invite-code field. Neither form is a
+        // terminal read (a TTY stdin is not read at all), so a message is accepted from either.
+        const text = o.code ?? (await readInviteFromStdin());
+        if (!text) {
+            io.writeStderr("link-redeem needs an invite code: pipe it (or the whole invite message) on stdin (e.g. `agent-board rooms link-redeem <<'MB_INVITE_CODE'` ... `MB_INVITE_CODE`) or pass --code (which leaks the bearer code via /proc and shell history).\n");
             process.exitCode = 1;
             return;
         }
-        return runHandler(io, "agent_board.redeem_invite_link", () => client.redeemInviteLink({ p_code: code }));
+        return runHandler(io, "agent_board.redeem_invite_link", () => client.redeemInviteLink({ p_code: parseInviteInput(text, { tty: false }).code }));
     });
+    // IF-0-ONBOARD-4: the caller's OWN join requests as they stand now (the RPC takes no identity:
+    // the session is the requester).
+    rooms
+        .command("my-requests")
+        .description("List your own join requests and where each stands (requested, joined, left, …; expired by age)")
+        .action(() => runHandler(io, "agent_board.list_my_board_requests", async () => ({
+        ok: true,
+        operation: "agent_board.list_my_board_requests",
+        data: await client.listMyBoardRequests(),
+    })));
 }
 function addInviteCommands(program, client, io) {
     const invite = program.command("invite").description("create bounded fleet onboarding invites");
@@ -3189,6 +3216,7 @@ function addDoctorCommand(program, io, doctor) {
         // Not `requiredOption`: commander's own usage exit would bypass the JSON envelope (#402).
         .option("--harness <harness>", "the harness to check (agy, claude, codex, grok, opencode, pi)")
         .option("--json", "print the report as JSON")
+        .option("--rescan", "scan for plaintext copies of a keyslot key now, instead of reusing a scan from the last 24 hours")
         .action(async (options) => {
         const harness = String(options.harness ?? "");
         let report;
@@ -3201,7 +3229,7 @@ function addDoctorCommand(program, io, doctor) {
             return;
         }
         try {
-            report = await doctor({ harness });
+            report = await doctor({ harness, ...(options.rescan === true ? { rescan: true } : {}) });
         }
         catch (error) {
             writeFailureEnvelope(io, toOperationFailure("agent_board.doctor", error));
@@ -3228,7 +3256,7 @@ export function fileAwareCredentials(selection, env = process.env) {
         return resolveCredentials(undefined, fileIdentityEnv(env, values));
     };
 }
-export function createProgram(client, io, enrollment = defaultEnrollmentRunner(), doctor = runDoctor, selection = {}, setup) {
+export function createProgram(client, io, enrollment = defaultEnrollmentRunner(), doctor = runDoctor, selection = {}, setup, setupAll) {
     const program = new Command()
         .name("agent-board")
         .description("Thin CLI surface for the agent_board RPC and canonical read contracts")
@@ -3259,7 +3287,7 @@ export function createProgram(client, io, enrollment = defaultEnrollmentRunner()
     addInviteCommands(program, client, io);
     addEnrollCommands(program, io, enrollment);
     addDoctorCommand(program, io, doctor);
-    addSetupCommand(program, io, setup ?? ((options) => runSetup(options, { enroll: setupEnroller })));
+    addSetupCommand(program, io, setup ?? ((options) => runSetup(options, { enroll: setupEnroller })), setupAllCommand(setupAll ?? ((options) => runSetupAll(options, { enroll: setupEnroller })), io));
     return program;
 }
 export async function runCli(argv, io = {
@@ -3272,6 +3300,6 @@ export async function runCli(argv, io = {
         ...options.clientOptions,
         resolveCredentials: fileAwareCredentials(selection, options.env ?? process.env),
     });
-    const program = createProgram(resolved, io, enrollment, doctor, selection, options.setup);
+    const program = createProgram(resolved, io, enrollment, doctor, selection, options.setup, options.setupAll);
     await program.parseAsync(argv, { from: "user" });
 }

package/dist/doctor.d.ts

@@ -1,5 +1,6 @@
-import { type IdentityHarness, type OperationSuccess, type OsKeychainBackendOptions, type OsKeychainExec, type SessionRecordEntry, type TrustOptions } from "@consiliency/agent-board-client";
-import { type ClaudePluginSummary, type RegistrationFs, type RegQuery, type RegistrationVerdict, type ScopeContext } from "./doctor_scopes.js";
+import { type HarnessProcess, type IdentityHarness, type OperationSuccess, type OsKeychainBackendOptions, type OsKeychainExec, type SessionRecordEntry, type TrustOptions } from "@consiliency/agent-board-client";
+import { type ClaudePluginSummary, type RegistrationFs, type RegQuery, type RegistrationVerdict, type ScopeContext, type ScopeFile } from "./doctor_scopes.js";
+import { type ScanBudgets, type StorageRunner } from "./keyslot_status.js";
 export type DoctorStatus = "pass" | "fail" | "undetermined";
 export declare const DOCTOR_CHECKS: readonly ["identity_file", "keystore_key", "key_storage", "whoami", "board_membership", "registration", "runtime"];
 export type DoctorCheckName = (typeof DOCTOR_CHECKS)[number];
@@ -7,6 +8,19 @@ export interface DoctorCheck {
     status: DoctorStatus;
     reason: string;
 }
+/**
+ * ONBOARD IF-0-ONBOARD-3 — `runtime`'s informational hint. It never changes `runtime`'s status or
+ * reason, or the exit code (pinned in `doctor_runtime_hint.test.ts`'s exit-invariance cases); where
+ * it overlaps `registration`'s existing `plugin_pin_mismatch`, that reason stays and the hint only
+ * explains it. Precedence when more than one applies: `session_predates_install`, then `no_session`
+ * (zero live records, and no pre-install process found either), then `stale_session_version`, then
+ * `no_target_first_session`, then `none`. `session_predates_install` is checked FIRST, ahead of
+ * `no_session`, because the motivating case (a harness that wrote no record at all before setup
+ * finished — the macmini claude case) has zero live records: a `no_session`-first order would
+ * mask it.
+ */
+export declare const RUNTIME_HINTS: readonly ["no_session", "stale_session_version", "session_predates_install", "no_target_first_session", "none"];
+export type RuntimeHint = (typeof RUNTIME_HINTS)[number];
 /**
  * CCPLUGIN IF-0-CCPLUGIN-3 — the claude plugin report. Outside `DOCTOR_CHECKS`: it never changes
  * the exit code. A version or ref prints only if it matches `REPORTABLE_TOKEN`, else
@@ -25,10 +39,37 @@ export interface PluginReport {
     version_from: "source" | "cache" | null;
     auto_update: ClaudePluginSummary["autoUpdate"];
 }
+/**
+ * #552 IF-552-3 — when the plaintext-key scan behind `key_storage` ran, and from where. A report,
+ * never a check: it does not change the exit. Present only once status.sh's measurement fields
+ * matched doctor's own (a report about another host, user or slot does not say when OUR scan ran).
+ * `source`: `fresh` (this doctor scanned), `cached` (a valid scan cache), `setup_run` (setup's
+ * in-process result, carried only where the cache could not store it), or `none` with `gave_up`
+ * when the scan hit its 30-minute bound.
+ */
+export interface KeyStorageScanReport {
+    source: "fresh" | "cached" | "setup_run" | "none";
+    scanned_at: string | null;
+    age_s: number | null;
+    duration_s: number | null;
+    cache_state: string | null;
+    gave_up?: {
+        after_s: number;
+        folders: number | null;
+    };
+}
 export interface DoctorReport {
     harness: IdentityHarness;
     exit: 0 | 1 | 2;
     checks: Record<DoctorCheckName, DoctorCheck>;
+    /**
+     * ONBOARD IF-0-ONBOARD-3 — informational only; omitted (not `"none"`) when nothing was found, so
+     * `Object.keys(report)` for a report with no `installedAt`/`installedVersion` evidence carried in
+     * is byte-unchanged from before this field existed.
+     */
+    runtime_hint?: RuntimeHint;
+    /** keyslot identities only (IF-552-3). */
+    key_storage_scan?: KeyStorageScanReport;
     /** claude only. */
     plugin?: PluginReport;
     /** claude only: wake hooks per required event in doctor's cwd, across settings and plugins. */
@@ -113,7 +154,73 @@ export interface DoctorOptions {
     machineIdFile?: string;
     /** key_storage: doctor's own uid. Default `process.getuid()`. */
     uid?: number;
+    /** `--rescan`: phase 2 always runs, as `--scan-cache fresh` (IF-552-3). */
+    rescan?: boolean;
+    /**
+     * SETUP ONLY, never a CLI flag: the key step's FRESH, validated clean scan, carried in-process so
+     * setup scans once where the cache could not store it. Used only under IF-552-3's three conditions.
+     */
+    setupScan?: SetupScan;
+    /** key_storage: where the scan notices go. Default `process.stderr`. */
+    writeStderr?: (line: string) => void;
+    /** key_storage: the status.sh runner and budgets (tests). */
+    statusRunner?: StorageRunner;
+    statusBudgets?: Partial<ScanBudgets>;
+    /** key_storage: the clock the carry's validity window reads, epoch seconds. Default now. */
+    nowSeconds?: () => number;
+    /**
+     * ONBOARD IF-0-ONBOARD-3 — when this harness's board package was last installed or upgraded.
+     * Overrides the default (`defaultInstallEvidence`, derived from doctor's own registration scan:
+     * claude's plugin verdict, or the winning scope file's mtime for every other harness). Where
+     * neither an override nor the default can prove one, `runtime_hint` never fires
+     * `session_predates_install`/`stale_session_version` from it — never fabricated from a guess.
+     */
+    installedAt?: Date;
+    /**
+     * ONBOARD IF-0-ONBOARD-3 — the version setup just installed or upgraded a package to, by that
+     * package's `packageName` (a live record's own field, since one harness's live records can carry
+     * more than one package — e.g. pi's own `wake_producer` plus mcp's `tools_only`, R-2). Overrides
+     * the default the same way `installedAt` does; null (or omitted entirely) makes no claim.
+     */
+    installedVersion?: (packageName: string) => string | null;
+    /**
+     * ONBOARD IF-0-ONBOARD-3 — this harness's own running processes, for `session_predates_install`.
+     * Default: the client's `listHarnessProcesses`. Test injection only needs to honour
+     * `startedBefore` when it cares about the cutoff; production always passes it.
+     */
+    harnessProcesses?: (harness: IdentityHarness, options: {
+        startedBefore?: Date;
+    }) => HarnessProcess[];
+    /**
+     * ONBOARD IF-0-ONBOARD-3 — the default `installedAt` derivation's own file-mtime read, for the
+     * config/plugin-source file that named a package's pinned version. Default: `fs.statSync(path).mtime`.
+     * Unrelated to `registrationFs.lstat`, which carries no mtime.
+     */
+    statMtime?: (path: string) => Date | null;
+}
+/** The key step's clean fresh scan, as setup carries it to its own doctor (IF-552-3). */
+export interface SetupScan {
+    /** `scan.inputs` of the key step's report: every field must deep-equal phase 1's. */
+    inputs: Record<string, unknown>;
+    /** The scan object itself (clean: `plaintext_matches` empty). */
+    scan: Record<string, unknown>;
+    /** The scan's start, epoch seconds. */
+    scannedAt: number;
+    /** The key step's own cache write, `<state>:<reason>` (e.g. `not_written:write_failed`). */
+    cacheWrite: string;
 }
+/** The IF-552-2 validity window, the same for the carry: `scannedAt ≤ now + 300` and `now − scannedAt < 86400`. */
+export declare const SCAN_CACHE_TTL_S = 86400;
+export declare const SCAN_CACHE_FUTURE_S = 300;
+/**
+ * IF-552-3's carry: setup's result serves instead of phase 2 only when (1) phase 1's `scan.inputs`
+ * deep-equals the carried inputs, (2) the cache could not serve STRUCTURALLY (phase 1 `unusable`
+ * with a structural reason, or `miss:absent` beside a key-step write of `not_written:untrusted_dir`
+ * or `write_failed`; `lock_busy` never qualifies: a held lock may be a tombstone being written), and
+ * (3) the carried scan is inside the validity window. Reads phase 1's `scan.cache`, never only
+ * `exit2_reasons`.
+ */
+export declare function carryQualifies(phase1: Record<string, unknown>, carried: SetupScan, now: number): boolean;
 /**
  * An error's `code`, only when this repository wrote it: a member of the derived
  * AUTHORED_CAUSE_CODES that this instance carries under the authored provenance brand — the
@@ -151,12 +258,46 @@ export declare function osKeychainProbe(spawn?: OsKeychainExec, where?: Pick<OsK
 /** The default agent_socket probe: the loaded key's fingerprint, derived from the agent's identity list. */
 export declare const agentSocketProbe: KeystoreProbe;
 export declare const OS_KEYCHAIN_PRESENT = "present; key_id proven server-side by whoami; file fingerprint unverified for os_keychain";
+/** Every exit-2 cause status.sh can emit (KSC-8 derives the list from status.sh and probe.sh). */
+export declare const STATUS_EXIT2_REASON: RegExp;
 interface FileIdentity {
     handle: string;
     fingerprint: string;
 }
 /** IF-0-CREDPATH-4 runtime, over already-read records. Exported for its fixtures. */
 export declare function judgeRuntime(harness: IdentityHarness, entries: readonly SessionRecordEntry[], identity: FileIdentity | null): DoctorCheck;
+/**
+ * ONBOARD IF-0-ONBOARD-3 — `runtime_hint`, over the SAME already-read `entries` `judgeRuntime` saw.
+ * Exported for its fixtures. Never reads `checks.runtime`'s own verdict, and never influences it:
+ * this is purely informational (see `RUNTIME_HINTS`'s doc comment for the precedence).
+ */
+export declare function judgeRuntimeHint(harness: IdentityHarness, entries: readonly SessionRecordEntry[], fs: Pick<RegistrationFs, "realpath">, options: Pick<DoctorOptions, "installedAt" | "installedVersion" | "harnessProcesses">): RuntimeHint;
+export interface DefaultInstallEvidence {
+    installedAt?: Date;
+    installedVersion: (packageName: string) => string | null;
+}
+/**
+ * ONBOARD IF-0-ONBOARD-3 — the default `installedAt`/`installedVersion`, derived ONLY from what
+ * doctor already reads for its own `registration` check (never a new probe): each scope file's
+ * board-identified mcp entry (codex/grok/agy, and claude's own non-plugin mcp registrations — an
+ * `npx -y @consiliency/agent-board-mcp@<version> …` stanza) and `packages`/`plugin` spec (pi,
+ * opencode — a pinned `<package>@<version>` entry). `files` is in ascending precedence (SAME as
+ * `readScopes` returns it), so a later file's match for the same package overrides an earlier
+ * one's, exactly as the harness itself would resolve it.
+ *
+ * For claude, the plugin verdict `pinCheck` already computed and trusts (never an unvalidated
+ * directory source) is preferred over a raw config scan, per its own `versionFrom`/`sourceKind`
+ * guard — the same one `pinCheck` applies.
+ *
+ * `installedAt` is the LATEST mtime among every file that named a version this way: several files
+ * naming different packages (pi's own `packages` row plus an unrelated mcp row) both count, since
+ * either being freshly written is evidence this harness's board setup was just touched. A file (or
+ * a claude directory source) whose mtime cannot be read contributes nothing — not an error, and
+ * never lowers the claim to "no evidence at all" by itself.
+ *
+ * Exported for its fixtures.
+ */
+export declare function defaultInstallEvidence(harness: IdentityHarness, plugin: ClaudePluginSummary | undefined, files: readonly ScopeFile[], fs: RegistrationFs, statMtime: (path: string) => Date | null): DefaultInstallEvidence;
 export declare function runDoctor(options: DoctorOptions): Promise<DoctorReport>;
 /** Human-readable form; `--json` prints the report object itself. */
 export declare function formatDoctorReport(report: DoctorReport): string;