@phnx-labs/agents-cli 1.20.76 → 1.20.78

package/dist/lib/auto-pull.js

@@ -2,12 +2,13 @@
  * Background sync for tracked git repos:
  *   - System repo (~/.agents/.system/) is read-only locally — fast-forward auto-pull is safe.
  *   - User repo (~/.agents/) and enabled extras may have local commits, so we only
- *     `git fetch` and write a status marker. Next CLI invocation surfaces a one-line
- *     notice if upstream is ahead. Pulling is left to the user via `agents repo pull`.
+ *     `git fetch` and write a status marker. `agents doctor` surfaces these markers
+ *     as a "Repo updates" section instead of printing to stderr on every command.
+ *     Pulling is left to the user via `agents repo pull`.
  *
  * Public API:
- *   spawnDetachedSync()           — fire-and-forget; never blocks the foreground command.
- *   printPendingUpdateNotices()   — synchronous; reads markers and prints + consumes them.
+ *   spawnDetachedSync()      — fire-and-forget; never blocks the foreground command.
+ *   readRepoBehindMarkers()  — synchronous; reads markers without consuming them.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -57,21 +58,29 @@ export function spawnDetachedSync() {
     }
 }
 /**
- * Read any pending status markers and print one-line notices for repos that
- * are behind upstream. Markers are deleted after printing so notices don't
- * repeat on every invocation. Synchronous, cheap (small JSON files).
+ * Read all current status markers and return those where the local repo is
+ * behind upstream. Markers are NOT deleted — they persist until the next
+ * background fetch overwrites them with fresh data.
+ *
+ * Synchronous, cheap (small JSON files). Used by `agents doctor` to surface
+ * repo-behind warnings in one place instead of printing to stderr on every
+ * command.
+ *
+ * @param fetchDir - Override the fetch state dir (for tests). Defaults to the
+ *   production getFetchCacheDir() path.
  */
-export function printPendingUpdateNotices() {
-    const dir = fetchStateDir();
+export function readRepoBehindMarkers(fetchDir) {
+    const dir = fetchDir ?? fetchStateDir();
     if (!fs.existsSync(dir))
-        return;
+        return [];
     let entries = [];
     try {
         entries = fs.readdirSync(dir);
     }
     catch {
-        return;
+        return [];
     }
+    const result = [];
     for (const name of entries) {
         if (!name.endsWith('.status.json'))
             continue;
@@ -81,25 +90,11 @@ export function printPendingUpdateNotices() {
             marker = JSON.parse(fs.readFileSync(file, 'utf-8'));
         }
         catch {
-            try {
-                fs.unlinkSync(file);
-            }
-            catch { /* ignore */ }
             continue;
         }
-        if (!marker || marker.behind <= 0) {
-            try {
-                fs.unlinkSync(file);
-            }
-            catch { /* ignore */ }
+        if (!marker || marker.behind <= 0)
             continue;
-        }
-        const repoLabel = marker.alias === 'user' ? '~/.agents/' : marker.alias;
-        process.stderr.write(`agents-cli: ${repoLabel} is ${marker.behind} commit${marker.behind === 1 ? '' : 's'} ` +
-            `behind ${marker.branch} — run 'agents repo pull ${marker.alias}' to update.\n`);
-        try {
-            fs.unlinkSync(file);
-        }
-        catch { /* ignore */ }
+        result.push(marker);
     }
+    return result;
 }

package/dist/lib/cloud/session-index.js

@@ -17,7 +17,7 @@
  * nothing to resolve or resume by id.
  */
 import { upsertSession } from '../session/db.js';
-import { SESSION_AGENTS } from '../session/types.js';
+import { isSessionTrackedAgent } from '../session/types.js';
 import { deriveShortId } from '../session/short-id.js';
 /** The execution-id charset the session index will accept as a row id. */
 const EXECUTION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/;
@@ -29,7 +29,7 @@ const EXECUTION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/;
  * failed index write must never break the dispatch/poll it rides on.
  */
 export function registerCloudSession(task, ctx = {}) {
-    if (!SESSION_AGENTS.includes(task.agent))
+    if (!task.agent || !isSessionTrackedAgent(task.agent))
         return;
     if (!task.id || !EXECUTION_ID_RE.test(task.id))
         return;

package/dist/lib/daemon.d.ts

@@ -69,18 +69,6 @@ export declare function reapStrayDaemons(keepPid?: number): {
 export declare function log(level: string, message: string): void;
 /** Main daemon loop: load jobs, schedule crons, monitor runs, and handle signals. */
 export declare function runDaemon(): Promise<void>;
-/**
- * Read the long-lived Claude OAuth token (from `claude setup-token`) that the
- * user stored under the `claude` secrets bundle. Resolves the bundle the same
- * way `agents run --secrets` does. Interactive starts may prompt Keychain;
- * headless auto-starts are broker-only and return null unless the user already
- * unlocked the bundle in the secrets agent. That keeps a background browser
- * command from hanging on an unseen biometric prompt. Never throws: an absent
- * token leaves the daemon on its existing interactive OAuth session.
- */
-export declare function readDaemonClaudeOAuthToken(opts?: {
-    allowPrompt?: boolean;
-}): string | null;
 /**
  * Write a launchd plist or systemd unit with owner-only permissions atomically.
  *
@@ -94,21 +82,19 @@ export declare function writeOwnerOnlyServiceManifest(filePath: string, content:
 /**
  * Generate a macOS launchd plist for auto-starting the daemon.
  *
- * The plist never embeds the Claude OAuth token (RUSH-1759): a persisted service
- * manifest is a plaintext credential on disk even at 0600. The daemon instead
- * obtains the token at startup from the `claude` secrets bundle
- * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the
- * Keychain-backed secure store and never touches the unit file.
+ * The plist never embeds a Claude OAuth token: the daemon holds no Claude
+ * credential at all. Routine runs authenticate through the per-account
+ * CLAUDE_CONFIG_DIR login on this device, exactly like an interactive
+ * `agents run`, so no credential ever touches the service manifest.
  */
 export declare function generateLaunchdPlist(agentsBin?: string): string;
 /**
  * Generate a Linux systemd user unit for auto-starting the daemon.
  *
- * The unit never embeds the Claude OAuth token (RUSH-1759): a persisted service
- * manifest is a plaintext credential on disk even at 0600. The daemon instead
- * obtains the token at startup from the `claude` secrets bundle
- * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the secure
- * store and never touches the unit file.
+ * The unit never embeds a Claude OAuth token: the daemon holds no Claude
+ * credential at all. Routine runs authenticate through the per-account
+ * CLAUDE_CONFIG_DIR login on this device, exactly like an interactive
+ * `agents run`, so no credential ever touches the unit file.
  */
 export declare function generateSystemdUnit(agentsBin?: string): string;
 export { getAgentsBinPath };
@@ -131,15 +117,6 @@ export declare function ensureDaemonStarted(): {
     pid: number | null;
     method: string;
 } | null;
-/**
- * Environment for the detached daemon fallback. The launchd/systemd paths
- * deliver the long-lived OAuth token via the service manifest's environment;
- * the detached path has no manifest, so inject it here. Read happens during an
- * interactive `routines start`, so a Keychain Touch ID prompt can be satisfied;
- * the daemon then passes it to every routine run it spawns. An already-set
- * value (e.g. inherited from launchd) is left untouched.
- */
-export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv, oauthToken?: string | null): NodeJS.ProcessEnv;
 /**
  * Resolve how to launch the daemon: `node <entry> __daemon-run`, matching the
  * exact form that works under a direct `__daemon-run`.
@@ -188,7 +165,7 @@ interface StartDetachedOptions {
     agentsBin?: string;
     /** Log file the daemon's stdio is redirected to (defaults to the daemon log). */
     logPath?: string;
-    /** Environment for the child (defaults to the OAuth-augmented detached env). */
+    /** Environment for the child (defaults to the daemon's current process env). */
     env?: NodeJS.ProcessEnv;
 }
 export declare function startDetached(opts?: StartDetachedOptions): {

package/dist/lib/daemon.js

@@ -13,13 +13,14 @@ import * as os from 'os';
 import { getDaemonDir as getDaemonDirRoot } from './state.js';
 import { isAlive, killTree, backgroundSpawnOptions } from './platform/index.js';
 import { listJobs as listAllJobs } from './routines.js';
+import { syncAllProjectRoutines } from './routines-project.js';
 import { JobScheduler } from './scheduler.js';
 import { MonitorEngine } from './monitors/engine.js';
 import { executeJobDetached, monitorRunningJobs } from './runner.js';
-import { detectOverdueJobs, notifyOverdue, notifyDesktop } from './overdue.js';
+import { detectOverdueJobs, notifyOverdue } from './overdue.js';
+import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from './routine-notify.js';
 import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
-import { readAndResolveBundleEnv } from './secrets/bundles.js';
 import { redactSecrets } from './redact.js';
 import { getAgentsBinPath, getCliLaunch, BUN_VIRTUAL_ROOT } from './cli-entry.js';
 const PID_FILE = 'daemon.pid';
@@ -32,12 +33,6 @@ const PLIST_NAME = 'com.phnx-labs.agents-daemon';
 const SYSTEMD_UNIT = 'agents-daemon.service';
 const MONITOR_TICK_MS = 60_000;
 const WEDGE_THRESHOLD_TICKS = 3;
-// A long-lived `claude setup-token` value stored in this secrets bundle/key is
-// baked into the daemon's service-manager environment so headless routine runs
-// authenticate without depending on the short-lived interactive Keychain OAuth
-// session (which expires between runs and produces intermittent 401s).
-const DAEMON_OAUTH_BUNDLE = 'claude';
-const DAEMON_OAUTH_KEY = 'CLAUDE_CODE_OAUTH_TOKEN';
 /**
  * RUSH-1817: decide whether the daemon should (re)take over hosting the secrets
  * broker. The startup host decision is one-shot; this drives the periodic
@@ -306,30 +301,13 @@ export async function runDaemon() {
         process.exit(0);
     }
     log('INFO', `Daemon started (PID: ${process.pid})`);
-    // RUSH-1759: the launchd plist / systemd unit no longer bake the Claude OAuth
-    // token onto disk. Obtain it here from the secure `claude` secrets bundle and
-    // inject into this process's env so every routine run this daemon spawns still
-    // receives it (via the sandbox allowlist), without the token ever being
-    // persisted in the service manifest. A read from a file-backed store (Linux)
-    // needs no prompt; on macOS it resolves broker-only from an unlocked
-    // secrets-agent and is otherwise absent (leaving the daemon on its existing
-    // interactive OAuth session), matching the detached-start path. Never blocks.
-    if (!process.env.CLAUDE_CODE_OAUTH_TOKEN) {
-        const oauthToken = readDaemonClaudeOAuthToken();
-        if (oauthToken) {
-            process.env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
-            log('INFO', 'Loaded Claude OAuth token from secrets bundle for routine runs');
-        }
-        else {
-            // No token available (e.g. a headless macOS daemon whose keychain was
-            // locked at start resolves broker-only and gets nothing). Historically
-            // this was silent, so every Claude routine the daemon spawned failed auth
-            // with no signal. Make it loud: WARN in the log and fire a desktop alert.
-            log('WARN', 'No Claude OAuth token available — Claude routine runs will fail auth on this host. ' +
-                'Restart the daemon with the keychain unlocked, or unlock the `claude` secrets bundle.');
-            notifyDesktop('agents daemon: no Claude credential', 'Claude routines will fail auth on this host. Restart the daemon with the keychain unlocked.');
-        }
-    }
+    // The daemon holds NO Claude credential of its own. Routine runs authenticate
+    // exactly like an interactive `agents run`: through the per-account
+    // CLAUDE_CONFIG_DIR login on this device (its own auto-refreshing
+    // .credentials.json). Claude Code's interactive access token is short-lived but
+    // refreshes itself per-device; a routine whose account login has gone dead is
+    // skipped up front by the auth-health preflight (runner.ts) with a re-login
+    // hint, rather than papered over by an injected fallback token.
     // Reap any stray duplicate daemon of this install that slipped past the start
     // lock or was orphaned by a hard-crash — before it can double-fire jobs.
     try {
@@ -372,14 +350,50 @@ export async function runDaemon() {
                 ? `workflow: ${config.workflow}`
                 : `agent: ${config.agent}`;
         log('INFO', `Triggering job '${config.name}' (${jobLabel})`);
+        // RUSH-2030: branded desktop notification on start (agent/workflow routines;
+        // suppressed for command housekeeping). Finish/output is fired from the
+        // onFinish hook below — executeJobDetached finalizes the run in-process, so
+        // the monitor tick never sees the live transition. Never let a notification
+        // failure break the trigger.
         try {
-            const meta = await executeJobDetached(config);
+            notifyRoutineStart(config);
+        }
+        catch { /* best-effort */ }
+        try {
+            const meta = await executeJobDetached(config, {
+                onFinish: (final) => {
+                    try {
+                        notifyRoutineFinish(final);
+                    }
+                    catch { /* best-effort */ }
+                },
+            });
             log('INFO', `Job '${config.name}' spawned (run: ${meta.runId}, PID: ${meta.pid})`);
         }
         catch (err) {
-            log('ERROR', `Job '${config.name}' failed to spawn: ${err.message}`);
+            const message = err.message;
+            log('ERROR', `Job '${config.name}' failed to spawn: ${message}`);
+            // RUSH-2030: the START ping already fired unconditionally above. A pre-spawn
+            // failure produces no run record and thus no onFinish, so send a synthetic
+            // "failed to start" finish here — otherwise the user is left with an orphaned
+            // "Routine started" and never told it failed.
+            try {
+                notifyRoutineStartFailed(config, message);
+            }
+            catch { /* best-effort */ }
         }
     });
+    // Materialise opted-in project routines into the user layer on every start
+    // so a fresh daemon picks up project YAML without a separate sync step.
+    try {
+        const result = syncAllProjectRoutines();
+        const n = result.projects.reduce((acc, p) => acc + p.synced.length, 0);
+        if (n > 0)
+            log('INFO', `Project routines sync: ${n} job(s) from ${result.projects.length} project(s)`);
+    }
+    catch (err) {
+        log('WARN', `Project routines sync failed: ${err.message}`);
+    }
     scheduler.loadAll();
     const scheduled = scheduler.listScheduled();
     log('INFO', `Loaded ${scheduled.length} jobs`);
@@ -721,6 +735,19 @@ export async function runDaemon() {
     const brokerSelfHealInterval = setInterval(() => { void runBrokerSelfHeal(); }, 60_000);
     const handleReload = () => {
         log('INFO', 'Reloading jobs (SIGHUP)');
+        // Refresh user-layer copies of opted-in project routines BEFORE the
+        // scheduler reloads, so YAML edits under `<project>/.agents/routines/`
+        // take effect on the next fire without a manual `routines sync`.
+        try {
+            const result = syncAllProjectRoutines();
+            const n = result.projects.reduce((acc, p) => acc + p.synced.length, 0);
+            if (n > 0 || result.missing.length > 0) {
+                log('INFO', `Project routines sync: ${n} updated, ${result.missing.length} missing roots`);
+            }
+        }
+        catch (err) {
+            log('WARN', `Project routines sync failed: ${err.message}`);
+        }
         scheduler.reloadAll();
         const reloaded = scheduler.listScheduled();
         log('INFO', `Reloaded ${reloaded.length} jobs`);
@@ -764,29 +791,6 @@ export async function runDaemon() {
     process.on('SIGINT', () => handleShutdown());
     await new Promise(() => { });
 }
-/**
- * Read the long-lived Claude OAuth token (from `claude setup-token`) that the
- * user stored under the `claude` secrets bundle. Resolves the bundle the same
- * way `agents run --secrets` does. Interactive starts may prompt Keychain;
- * headless auto-starts are broker-only and return null unless the user already
- * unlocked the bundle in the secrets agent. That keeps a background browser
- * command from hanging on an unseen biometric prompt. Never throws: an absent
- * token leaves the daemon on its existing interactive OAuth session.
- */
-export function readDaemonClaudeOAuthToken(opts = {}) {
-    try {
-        const allowPrompt = opts.allowPrompt ?? Boolean(process.stdin.isTTY);
-        const { env } = readAndResolveBundleEnv(DAEMON_OAUTH_BUNDLE, {
-            caller: 'daemon',
-            agentOnly: !allowPrompt,
-        });
-        const token = (env[DAEMON_OAUTH_KEY] ?? '').trim();
-        return token.length > 0 ? token : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** Escape a string for safe inclusion in an XML <string> node. */
 function xmlEscape(s) {
     return s
@@ -814,11 +818,10 @@ export function writeOwnerOnlyServiceManifest(filePath, content) {
 /**
  * Generate a macOS launchd plist for auto-starting the daemon.
  *
- * The plist never embeds the Claude OAuth token (RUSH-1759): a persisted service
- * manifest is a plaintext credential on disk even at 0600. The daemon instead
- * obtains the token at startup from the `claude` secrets bundle
- * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the
- * Keychain-backed secure store and never touches the unit file.
+ * The plist never embeds a Claude OAuth token: the daemon holds no Claude
+ * credential at all. Routine runs authenticate through the per-account
+ * CLAUDE_CONFIG_DIR login on this device, exactly like an interactive
+ * `agents run`, so no credential ever touches the service manifest.
  */
 export function generateLaunchdPlist(agentsBin = getAgentsBinPath()) {
     const launch = getDaemonLaunch(agentsBin);
@@ -856,11 +859,10 @@ function systemdExecArg(value) {
 /**
  * Generate a Linux systemd user unit for auto-starting the daemon.
  *
- * The unit never embeds the Claude OAuth token (RUSH-1759): a persisted service
- * manifest is a plaintext credential on disk even at 0600. The daemon instead
- * obtains the token at startup from the `claude` secrets bundle
- * (readDaemonClaudeOAuthToken, injected in runDaemon), so it stays in the secure
- * store and never touches the unit file.
+ * The unit never embeds a Claude OAuth token: the daemon holds no Claude
+ * credential at all. Routine runs authenticate through the per-account
+ * CLAUDE_CONFIG_DIR login on this device, exactly like an interactive
+ * `agents run`, so no credential ever touches the unit file.
  */
 export function generateSystemdUnit(agentsBin = getAgentsBinPath()) {
     const launch = getDaemonLaunch(agentsBin);
@@ -1004,22 +1006,6 @@ function startDaemonLocked(agentsBin) {
     }
     return startDetached({ agentsBin });
 }
-/**
- * Environment for the detached daemon fallback. The launchd/systemd paths
- * deliver the long-lived OAuth token via the service manifest's environment;
- * the detached path has no manifest, so inject it here. Read happens during an
- * interactive `routines start`, so a Keychain Touch ID prompt can be satisfied;
- * the daemon then passes it to every routine run it spawns. An already-set
- * value (e.g. inherited from launchd) is left untouched.
- */
-export function buildDetachedDaemonEnv(baseEnv = process.env, oauthToken = readDaemonClaudeOAuthToken()) {
-    const env = { ...baseEnv };
-    if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
-        if (oauthToken)
-            env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
-    }
-    return env;
-}
 /**
  * Resolve how to launch the daemon: `node <entry> __daemon-run`, matching the
  * exact form that works under a direct `__daemon-run`.
@@ -1099,7 +1085,7 @@ export function startDetached(opts = {}) {
     const child = spawn(command, args, {
         stdio: ['ignore', logFd, logFd],
         ...backgroundSpawnOptions({ fdStdio: true }),
-        env: opts.env ?? buildDetachedDaemonEnv(),
+        env: opts.env ?? process.env,
     });
     // A failed spawn (ENOENT/EACCES) emits 'error' asynchronously; without a
     // listener that would crash the parent as an unhandled EventEmitter error.

package/dist/lib/devices/fleet-divergence.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Cross-device harness divergence for `agents doctor` (RUSH-2027).
+ *
+ * `agents fleet status` already fans out `agents doctor --json` per device and
+ * builds a {@link FleetHealthReport} of coarse device health (reachable, CLIs
+ * installed, agents-cli version skew, local sync drift). It deliberately does
+ * NOT compare fine-grained *resource presence* across devices — so a plugin like
+ * `swarm` installed on one box but missing on another is silent until a user
+ * types `/swarm:run` on the wrong machine and gets `Unknown command`.
+ *
+ * This module is the missing comparison. Each device self-reports its installed
+ * inventory (resource kinds, per-agent version sets, `.agents`/`.system` repo
+ * state) in its `doctor --json` payload; {@link compareFleetInventories} takes
+ * the collected per-device inventories and, treating the local machine as the
+ * baseline, flags:
+ *
+ *   1. Resource presence gaps  — a resource present on one device, missing on
+ *      another (either direction relative to the local baseline).
+ *   2. Agent version gaps      — an agent version installed on one device but
+ *      not another (e.g. `yosemite-s0 missing claude@2.1.220`).
+ *   3. `.agents`/`.system` repo drift — a device whose config-repo HEAD, branch,
+ *      or dirty state diverges from the local baseline.
+ *
+ * Pure and SSH-free: the SSH fan-out lives in the doctor command; this module
+ * only consumes the already-collected payloads, so the divergence logic is
+ * unit-tested against fixture inventories with no live fleet.
+ */
+/** Resource kinds compared across devices. Mirrors {@link DoctorKind} plus the
+ *  top-level `workflows`/`memory` inventory that `getAvailableResources` emits;
+ *  `promptcuts` is a single present/absent bit surfaced as one named resource. */
+export type FleetResourceKind = 'commands' | 'skills' | 'hooks' | 'rules' | 'mcp' | 'permissions' | 'subagents' | 'plugins' | 'promptcuts' | 'workflows';
+export declare const FLEET_RESOURCE_KINDS: FleetResourceKind[];
+/** Per-repo state for the `.agents` (user) or `.system` config repo, as a device
+ *  self-reports it. `null` fields mean "not a git repo / unreadable" on that box. */
+export interface RepoState {
+    /** Current branch, or null when detached / unreadable. */
+    branch: string | null;
+    /** Short HEAD commit (8 chars), or null when unreadable. */
+    head: string | null;
+    /** True when the working tree has uncommitted changes. */
+    dirty: boolean;
+}
+/**
+ * The self-reported harness inventory a single device emits in `doctor --json`.
+ * Comparable device-to-device with no further probing.
+ */
+export interface FleetInventory {
+    /** Installed resource names per kind. `rules` here are the top-level rules
+     *  files (memory presets), not per-agent compiled AGENTS.md. */
+    resources: Record<FleetResourceKind, string[]>;
+    /** Installed version ids per agent id (e.g. `{ claude: ['2.1.170','2.1.220'] }`). */
+    agentVersions: Record<string, string[]>;
+    /** State of the user (`~/.agents`) and system (`~/.agents/.system`) config repos. */
+    repos: {
+        agents: RepoState | null;
+        system: RepoState | null;
+    };
+}
+/** A device's inventory paired with its name (and reachability). A device that
+ *  was unreachable / failed to report carries `inventory: null` and is skipped
+ *  by the comparison (its absence is a `fleet status` concern, not divergence). */
+export interface DeviceInventory {
+    name: string;
+    inventory: FleetInventory | null;
+}
+export type FleetDivergenceKind = 'resource-missing-remote' | 'resource-missing-local' | 'agent-version-missing-remote' | 'agent-version-missing-local' | 'repo-drift';
+/** One cross-device divergence finding, baseline = the local machine. */
+export interface FleetDivergence {
+    kind: FleetDivergenceKind;
+    /** The device the finding is about (the remote box, or the local box for a
+     *  `*-missing-local` finding where a remote has something local lacks). */
+    device: string;
+    /** Resource kind for a resource finding; agent id for a version finding;
+     *  `agents`/`system` for a repo finding. */
+    category: string;
+    /** The specific resource name / version id / repo label that diverges. */
+    name: string;
+    /** Human-readable one-liner, ready for the warnings list. */
+    message: string;
+}
+export interface FleetDivergenceReport {
+    /** Name of the device used as the comparison baseline (the local machine). */
+    baseline: string;
+    divergences: FleetDivergence[];
+    /** Devices that reported an inventory and were compared. */
+    comparedDevices: string[];
+    /** Devices that could not be compared (offline / no inventory in payload). */
+    skippedDevices: string[];
+    hasDivergence: boolean;
+}
+/**
+ * Compare a set of per-device inventories against the local baseline and emit
+ * every cross-device divergence. The baseline is the device whose name equals
+ * {@link baselineName} (the local machine); if that device has no inventory the
+ * report is empty (nothing to compare against). Devices with no inventory are
+ * recorded under `skippedDevices` and never produce false "missing" findings.
+ *
+ * Ordering is deterministic (device, then category, then name) so the human and
+ * JSON output — and the tests — are stable.
+ */
+export declare function compareFleetInventories(devices: DeviceInventory[], baselineName: string): FleetDivergenceReport;