fix(agents): make agents mentionable by non-owners (desktop eligibility gate + kind:10100 directory)

[dexsynccom]

Problem

On a multi-user deployment, only an agent's creator could interact with it from the desktop app. Other channel members typed @Agent … and got silence — the message posted normally, the relay accepted it, and the agent stayed healthy and kept answering its owner. The same members could reach the agent from the mobile app.

Root cause

Desktop mention p tags are only produced for identities present in the composer's mentionCandidates list — both the autocomplete picker and the send-time text matcher (extractMentionPubkeys) draw from it. isAgentIdentityInManagedList (#2149) drops every agent-flagged candidate not present in the local managed-agents list, and only the owner's machine has the agent there. Every feed into the candidate list flags such an agent (role == "bot" from kind:39002 membership; client-side NIP-OA owner verification on kind:0 for profile and search rows), so for non-owners the candidate is dropped on every path. Typing @Agent stays plain text, the event carries no p tag — and since the harness's Mentions mode subscribes with #p=[agent] in its REQ, the relay never even delivers the message to the agent. Nothing errors anywhere; mobile was unaffected because its member candidates have no such gate.

Compounding it, nothing anywhere published kind:10100 agent-directory profiles, so the respond_to-aware eligibility both clients already implement (relayAgentIsSharedWithUser / mobile agentIsSharedWithUser) had no data — respond_to=anyone was invisible to other users' clients.

Changes

fix(desktop): let non-owners @-mention channel-member agents

• Scope isAgentIdentityInManagedList to agents owned by the current user (compared via the verified NIP-OA ownerPubkey), preserving fix(desktop): prefer live agent mentions #2149's stale-incarnation dedupe while letting foreign/unknown-owned agents fall through to shouldHideAgentFromMentions — whose member/directory policy applies again (member agents with unknown invocability are shown; non-member, non-invocable agents stay hidden).
• Pass currentPubkey at both call sites (useMentions, MembersSidebar add-member search).
• Move three pure helpers from useMentions.ts into mentionCandidates.ts to stay under the 1000-line file ratchet.
• Unit tests for the owner-scoped semantics.

feat(acp): publish kind:10100 agent directory profile

• New publish_agent_profile publishes/refreshes the replaceable kind:10100 at the presence-online readiness boundary and republishes when membership notifications change the subscribed channel set.
• Content carries the cross-client contract fields — respond_to, respond_to_allowlist, channel_ids, channel_add_policy — already parsed by desktop agents_from_events, mobile AgentDirectoryEntry.fromEvent, and required by the relay's ingest side effect.
• Discovery metadata only: the inbound author gate (author_allowed) remains the enforcement point.
• Unit tests for the content contract, including the exact respond_to strings clients compare.

Testing

• just ci green end-to-end (fmt, clippy, desktop check/build/unit tests, Tauri fmt/check/tests, mobile analyze/tests).
• 672 unit tests across the touched desktop modules pass; 2 new harness tests pass.
• Existing e2e mention-hiding semantics verified unchanged (mentions.spec.ts: foreign-owned non-member agents still hidden; own profile-only agents still hidden).
• Root-caused on a live multi-user deployment: wire evidence (relay events/event_mentions) showed every non-owner message missing the agent p tag while the owner's carried it, with the same user succeeding from mobile and failing from desktop.

🤖 Generated with Claude Code