Multi-device: mention picker cannot reach remotely-hosted agents (owner-only unhandled, directory never updated, replies never p-tag authors)

[Matweiss]

Setup: one user, two devices, same key. Device A's Buzz Desktop hosts the agents; device B is a pure client (same identity imported). Community = the user + their agents.

Symptom: on device B the @ picker offers no agents at all (only the user's own name). Plain-typed @NAMEs and thread replies publish but notify nobody, and agents wake only on p-tagged events (buzz-acp shipped default subscribe = "mentions" with require_mention = true, crates/buzz-acp/src/config.rs) — so device B has no channel path to reach any agent. (Deployments can override via BUZZ_ACP_SUBSCRIBE / BUZZ_ACP_NO_MENTION_FILTER; this issue describes the code default.)

Defect 1 — eligibility: desktop/src/features/agents/lib/agentAutocompleteEligibility.ts — relayAgentIsSharedWithUser() handles respondTo allowlist/anyone only; no owner-only branch, and RelayAgent carries no ownerPubkey (the kind:10100 card has no owner field), so owner-only agents are hidden even from their own owner on every non-hosting device.

Defect 2 — settings cannot propagate: Desktop saves respond-to edits into the owner-side kind:30177 managed-agent record, but the picker reads kind:10100 cards — and repo-wide the only kind:10100 writer is buzz-cli channels set-add-policy (content = {"channel_add_policy"} only). No code path ever writes or updates respond_to/channel_ids on the card, so switching an agent to Anyone/Selected-people can never make it picker-visible on another device.

Defect 3 — replies never p-tag the parent author: thread_tags() in crates/buzz-sdk/src/builders.rs emits only NIP-10 e-tags; Desktop's messageMentionPubkeys.ts states "Stream messages notify only explicit mentions." So "reply to a message to reach its author" is impossible for every client, which removes the natural fallback for defects 1-2.

Defect 4 — misleading dialog copy: the Selected-people edit dialog tells the owner "you don't need to add yourself" (desktop/src/features/agents/ui/RespondToField.tsx:334), but picker eligibility checks the literal published allowlist — following the dialog makes the fix silently fail even once defect 2 is repaired.

Suggested direction: publish ownerPubkey on the directory card and add an owner-only branch; republish (or relay-derive) directory data when respond-to changes, or let a client read its own owner's kind:30177 records; p-tag the parent author on replies per NIP-10; fix the dialog copy.

Impact: every multi-device user; becomes fleet-wide once agents run headless/remote (VPS), where every client is a non-hosting device.

[Matweiss]

Addendum — one more interaction found after the report above was finalized (verified independently by two reviewers):

Archived identities are stripped from the mention picker on every device, which collides with migrating an agent to a headless host. useIsArchivedPredicate (desktop/src/features/identity-archive/hooks.ts) is applied to picker candidates in useMentions.ts before the eligibility check from Defect 1 even runs, and NIP-IA archive (kind 9035 → relay snapshot kind 13535) is identity-global, not per-device.

Why this bites: Buzz Desktop lazy-starts a locally-configured managed agent when it sees a mention for it (even with start-on-launch off), so the only reliable way to stop a Desktop from hosting an identity that has moved to another host (e.g. headless buzz-acp on a server) is to Archive the local card. But that archives the identity relay-wide — hiding a live, responding agent from the @ picker on every device, and that hiding persists even once Defects 1–2 are fixed. DM recipient tagging is a separate code path that never checks archive status, so DMs remain the only contact route.

Live repro: identity migrated Mac → headless VPS via buzz-acp; Mac copy archived to prevent duplicate responders; agent healthy, present, and responding on the VPS — yet absent from the picker on all devices, including the one that hosts nothing.

Suggested direction (may deserve its own issue — happy to split it out): a per-device "stop hosting" control distinct from identity-level archive, or excluding identities from the picker's archive-strip when the directory still marks them reachable/alive.

[wolfyy970]

This is the lifecycle split I’m proposing in #4301. “Stop hosting here” should disable only this device’s execution binding. The agent’s identity and template remain intact while hosting moves between local and remote runtimes.