feat(desktop): refine agent catalog sharing

desktop/src-tauri/src/commands/agent_config.rs

@@ -21,8 +21,7 @@ use crate::{
 
 /// Subset of the goose file config exposed to the frontend for gate evaluation.
 ///
-/// Only the fields the dialog gate needs — not the full `RuntimeConfigSurface`.
-/// The gate uses this to know which requirements are already satisfied in the
+/// Only the fields the dialog gate needs. This tracks which requirements are already satisfied in the
 /// harness config file, so it can show "Set in goose config" rather than
 /// surfacing a false missing-key marker.
 #[derive(Debug, Serialize)]
@@ -685,6 +684,7 @@ mod tests {
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
             definition_respond_to: None,
@@ -709,6 +709,7 @@ mod tests {
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
             env_vars: Default::default(),

desktop/src-tauri/src/commands/agent_models_tests.rs

@@ -394,6 +394,7 @@ fn model_discovery_ignores_stale_record_for_linked_agent() {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
         env_vars: BTreeMap::new(),

desktop/src-tauri/src/commands/agents.rs

@@ -6,8 +6,8 @@ use crate::{
     managed_agents::{
         build_managed_agent_summary, current_instance_id, discover_provider_candidates,
         ensure_persona_is_active, find_managed_agent_mut, load_managed_agents, load_personas,
-        load_teams, managed_agent_avatar_url, managed_agents_base_dir, normalize_agent_args,
-        provider_deploy, resolve_provider_binary, save_managed_agents, start_managed_agent_process,
+        load_teams, managed_agent_avatar_url, normalize_agent_args, provider_deploy,
+        resolve_provider_binary, save_managed_agents, start_managed_agent_process,
         stop_managed_agent_process, stop_managed_agent_workspace_pair,
         sync_managed_agent_processes, try_regenerate_nest, validate_provider_config, BackendKind,
         CreateManagedAgentRequest, CreateManagedAgentResponse, ManagedAgentRecord,
@@ -18,8 +18,7 @@ use crate::{
     util::now_iso,
 };
 
-/// Read the workspace owner's pubkey hex from app state without holding the
-/// lock for longer than necessary. Used to populate `BUZZ_ACP_AGENT_OWNER`
+/// Read the workspace owner pubkey without holding the lock. Used to populate `BUZZ_ACP_AGENT_OWNER`
 /// as a fallback for legacy agent records that have no NIP-OA `auth_tag`.
 pub(super) fn workspace_owner_hex(state: &AppState) -> Result<String, String> {
     let keys = state.keys.lock().map_err(|e| e.to_string())?;
@@ -54,14 +53,15 @@ pub(super) fn retain_managed_agent_pending(
     use nostr::JsonUtil;
 
     let result = (|| -> Result<(), String> {
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let conn = open_retention_db(&scope.db_path)?;
         // The published content is the opt-IN projection JSON, independent of
         // signing and created_at. Compute it once to drive the no-republish
         // guard without signing twice.
         let content = serde_json::to_string(&agent_event_content(record))
             .map_err(|e| format!("failed to serialize managed-agent content: {e}"))?;
         let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
+            let keys = &scope.owner_keys;
             let owner_pubkey = keys.public_key().to_hex();
             let existing =
                 get_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, &record.pubkey)?;
@@ -75,7 +75,7 @@ pub(super) fn retain_managed_agent_pending(
             // Monotonic created_at: bump past the retained head (NIP-AP step 3).
             let event = build_agent_event(record)?
                 .custom_created_at(monotonic_created_at(existing.map(|row| row.created_at)))
-                .sign_with_keys(&keys)
+                .sign_with_keys(keys)
                 .map_err(|e| format!("failed to sign managed-agent event: {e}"))?;
             (owner_pubkey, event)
         };
@@ -126,15 +126,12 @@ pub(super) fn tombstone_managed_agent_pending(
     const KIND_DELETE: u32 = 5;
 
     let result = (|| -> Result<(), String> {
-        let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
-            let owner_pubkey = keys.public_key().to_hex();
-            let event = build_agent_delete(agent_pubkey, &owner_pubkey)?
-                .sign_with_keys(&keys)
-                .map_err(|e| format!("failed to sign managed-agent tombstone: {e}"))?;
-            (owner_pubkey, event)
-        };
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let owner_pubkey = scope.owner_keys.public_key().to_hex();
+        let event = build_agent_delete(agent_pubkey, &owner_pubkey)?
+            .sign_with_keys(&scope.owner_keys)
+            .map_err(|e| format!("failed to sign managed-agent tombstone: {e}"))?;
+        let conn = open_retention_db(&scope.db_path)?;
         delete_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, agent_pubkey)?;
         retain_event(
             &conn,
@@ -220,13 +217,10 @@ pub(super) fn archive_managed_agent_pending(app: &AppHandle, state: &AppState, a
     use nostr::JsonUtil;
 
     let result = (|| -> Result<(), String> {
-        let (owner_pubkey, event) = {
-            let keys = state.signing_keys()?;
-            let owner_pubkey = keys.public_key().to_hex();
-            let event = build_agent_archive_request(&keys, agent_pubkey)?;
-            (owner_pubkey, event)
-        };
-        let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+        let owner_pubkey = scope.owner_keys.public_key().to_hex();
+        let event = build_agent_archive_request(&scope.owner_keys, agent_pubkey)?;
+        let conn = open_retention_db(&scope.db_path)?;
         retain_event(
             &conn,
             &RetainedEvent {
@@ -941,6 +935,7 @@ pub async fn create_managed_agent(
             name_pool: Vec::new(),
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
             definition_respond_to: None,

desktop/src-tauri/src/commands/agents_tests.rs

@@ -53,6 +53,7 @@ fn bare_agent_record(
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
         relay_mesh: None,
@@ -75,6 +76,7 @@ fn persona_record(id: &str, model: Option<&str>, provider: Option<&str>) -> Agen
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
         env_vars: BTreeMap::new(),

desktop/src-tauri/src/commands/media_download.rs

@@ -610,6 +610,7 @@ mod tests {
             version: FORMAT_VERSION,
             definition: AgentSnapshotDefinition {
                 name: "test".to_string(),
+                source_is_builtin: false,
                 system_prompt: None,
                 runtime: None,
                 model: None,
@@ -659,6 +660,7 @@ mod tests {
             version: FORMAT_VERSION,
             definition: AgentSnapshotDefinition {
                 name: "test".to_string(),
+                source_is_builtin: false,
                 system_prompt: None,
                 runtime: None,
                 model: None,
@@ -704,6 +706,7 @@ mod tests {
             version: FORMAT_VERSION,
             definition: AgentSnapshotDefinition {
                 name: "test".to_string(),
+                source_is_builtin: false,
                 system_prompt: None,
                 runtime: None,
                 model: None,

desktop/src-tauri/src/commands/media_snapshot_png.rs

@@ -158,6 +158,7 @@ mod tests {
             version: 1,
             definition: AgentSnapshotDefinition {
                 name: "Tree Trunks".to_string(),
+                source_is_builtin: false,
                 system_prompt: Some("You are a helpful agent.".to_string()),
                 runtime: Some("goose".to_string()),
                 model: None,

desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs

@@ -61,6 +61,7 @@ fn make_agent(
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
         relay_mesh: None,

desktop/src-tauri/src/commands/personas/inbound_tests.rs

@@ -20,6 +20,7 @@ fn local_in_app() -> AgentDefinition {
         name_pool: vec!["Local".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: Some("team-1".to_string()),
         source_team_persona_slug: None,
         env_vars: BTreeMap::from([("API_KEY".to_string(), "secret".to_string())]),
@@ -45,6 +46,7 @@ fn inbound_for(d_tag: &str, display_name: &str) -> AgentDefinition {
         name_pool: vec!["Remote".to_string()],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: Some(d_tag.to_string()),
         env_vars: BTreeMap::new(),
@@ -203,6 +205,7 @@ fn local_agent() -> ManagedAgentRecord {
         name_pool: Vec::new(),
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
         definition_respond_to: None,

desktop/src-tauri/src/commands/personas/mod.rs

@@ -33,6 +33,8 @@ fn trim_optional(value: Option<String>) -> Option<String> {
 mod pending;
 pub(in crate::commands) use pending::retain_persona_pending;
 pub(super) use pending::tombstone_persona_pending;
+mod sharing;
+pub use sharing::set_persona_shared;
 
 #[tauri::command]
 pub async fn list_personas(app: AppHandle) -> Result<Vec<AgentDefinition>, String> {
@@ -43,7 +45,9 @@ pub async fn list_personas(app: AppHandle) -> Result<Vec<AgentDefinition>, Strin
             .managed_agents_store_lock
             .lock()
             .map_err(|error| error.to_string())?;
-        load_personas(&app)
+        let mut personas = load_personas(&app)?;
+        pending::project_active_persona_sharing(&app, &state, &mut personas)?;
+        Ok(personas)
     })
     .await
     .map_err(|e| format!("spawn_blocking failed: {e}"))?
@@ -70,6 +74,7 @@ pub async fn create_persona(
             .lock()
             .map_err(|error| error.to_string())?;
         let mut personas = load_personas(&app)?;
+        pending::project_active_persona_sharing(&app, &state, &mut personas)?;
         let name_pool: Vec<String> = input
             .name_pool
             .into_iter()
@@ -88,6 +93,7 @@ pub async fn create_persona(
             name_pool,
             is_builtin: false,
             is_active: true,
+            shared: false,
             source_team: None,
             source_team_persona_slug: None,
             env_vars: input.env_vars,
@@ -170,6 +176,7 @@ pub async fn update_persona(
                 .lock()
                 .map_err(|error| error.to_string())?;
             let mut personas = load_personas(&app)?;
+            pending::project_active_persona_sharing(&app, &state, &mut personas)?;
             let persona = personas
                 .iter_mut()
                 .find(|record| record.id == input.id)
@@ -551,7 +558,7 @@ fn reconcile_inbound_persona_event_blocking(
 ) -> Result<(), String> {
     use crate::managed_agents::{
         agent_events::managed_agent_content_from_event,
-        load_managed_agents, load_teams, managed_agents_base_dir,
+        load_managed_agents, load_teams,
         persona_events::persona_from_event,
         retention::{open_retention_db, retain_inbound_event, InboundOutcome, RetainedEvent},
         save_managed_agents, save_teams,
@@ -599,7 +606,8 @@ fn reconcile_inbound_persona_event_blocking(
         .map_err(|error| error.to_string())?;
 
     // Resolve inbound vs. any pending local edit before touching the store.
-    let conn = open_retention_db(&managed_agents_base_dir(&app)?.join("retention.db"))?;
+    let scope = crate::managed_agents::retention::active_retention_scope(&app, &state)?;
+    let conn = open_retention_db(&scope.db_path)?;
     let outcome = retain_inbound_event(
         &conn,
         &RetainedEvent {
@@ -703,7 +711,7 @@ fn reconcile_inbound_tombstone(
     state: &AppState,
 ) -> Result<(), String> {
     use crate::managed_agents::{
-        load_managed_agents, load_teams, managed_agents_base_dir,
+        load_managed_agents, load_teams,
         retention::{
             open_retention_db, retain_inbound_event, tombstone_retention_d_tag, InboundOutcome,
             RetainedEvent,
@@ -728,7 +736,8 @@ fn reconcile_inbound_tombstone(
     // Resolve against the retained tombstone row (keyed by the target
     // coordinate, F2c) so a re-received tombstone or one older than a pending
     // local edit is a no-op.
-    let conn = open_retention_db(&managed_agents_base_dir(app)?.join("retention.db"))?;
+    let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
+    let conn = open_retention_db(&scope.db_path)?;
     let outcome = retain_inbound_event(
         &conn,
         &RetainedEvent {
@@ -815,6 +824,7 @@ fn apply_inbound_persona(personas: &mut Vec<AgentDefinition>, inbound: AgentDefi
             local.respond_to = inbound.respond_to;
             local.respond_to_allowlist = inbound.respond_to_allowlist;
             local.parallelism = inbound.parallelism;
+            local.shared = inbound.shared;
             local.updated_at = inbound.updated_at;
         }
         None => personas.push(inbound),

desktop/src-tauri/src/commands/personas/name_propagation_tests.rs

@@ -50,6 +50,7 @@ fn agent(persona_id: &str, name: &str, display_name: Option<&str>) -> ManagedAge
         name_pool: vec![],
         is_builtin: false,
         is_active: true,
+        shared: false,
         source_team: None,
         source_team_persona_slug: None,
         definition_respond_to: None,