feat(agents): register existing remote identities

[conrelma]

Summary

• Add buzz agents draft-adopt to open an owner-reviewed Register existing agent dialog for an already-operated remote Nostr identity.
• Fail closed unless the remote agent's signed kind-0 profile attests the active signer as owner, the relay/signer scope is unchanged, the identity is not archived, and no local managed-agent record uses the pubkey.
• Publish only the minimal owner-signed kind-30177 policy (name, parallelism: 1, respond_to: owner-only, and d=<agent pubkey>). The request and builder cannot carry a private key, runtime, provider, prompt, process, or local managed-agent record.
• Add parser/backend contract tests and a Playwright owner-review workflow that proves registration does not call create_managed_agent.

This does not change channel roles or start/stop/configure a remote runtime. Those remain separate owner actions.

Related issue

N/A. The closest adjacent work is #6321, which made externally operated agent references display-only but did not provide an owner-side registration flow.

Testing

• just ci
• pnpm --dir desktop build:e2e
• pnpm --dir desktop exec playwright test --project=smoke tests/e2e/register-existing-agent.spec.ts

Both were run on commit 39814890c00907ecaec5520ce0554e7283ca7f0d.

[AlmogBaku]

Tested workaround for an externally operated native Hermes agent while draft-adopt is unavailable:

1. Create a normal managed agent in Buzz Desktop. Desktop generates the agent keypair, owner-signed NIP-OA tag, and relay-side managed-agent records.
2. Stop that Desktop runtime and disable start-on-launch so it cannot race the external runtime.
3. On macOS, read the agent pubkey and auth_tag from:
   ~/Library/Application Support/xyz.block.buzz.app/agents/managed-agents.json
4. Read the nsec from the buzz-desktop Keychain entry. The entry account is secrets; its value is a JSON map and the agent key is agent:<pubkey>:

security find-generic-password -s buzz-desktop -a secrets -w |
  jq -r --arg key "agent:$PUBKEY" '.[$key]'

Then configure the external runtime with that nsec, auth tag, and relay URL. We tested this with the native Hermes Buzz gateway against a hosted communities.buzz.xyz relay: Hermes operates as the exact Desktop-created identity, and Buzz recognizes it as the owner-managed agent.

Important caveats:

• The supported Desktop agent snapshot export intentionally excludes both private_key_nsec and auth_tag; this reads internal storage and is not a stable public interface.
• Never run the Desktop harness and Hermes simultaneously with the same identity.
• This workaround transfers custody of a Desktop-minted identity. draft-adopt remains the cleaner design for an existing external key because only its public key crosses the review flow.

One possible small complementary feature would be an explicit, one-time credential handoff/export at managed-agent creation. Internally, create_managed_agent already returns private_key_nsec; the frontend currently discards it.

macOS helper

Requires jq. Replace the relay placeholder, then paste the pubkey copied from Buzz.

#!/usr/bin/env bash
set -euo pipefail

relay="https://YOUR-COMMUNITY.communities.buzz.xyz"
store="$HOME/Library/Application Support/xyz.block.buzz.app/agents/managed-agents.json"

read -rp "Agent pubkey: " pubkey
auth_tag=$(jq -r --arg p "$pubkey" '.[] | select(.pubkey == $p) | .auth_tag' "$store")
private_key=$(security find-generic-password -s buzz-desktop -a secrets -w |
  jq -r --arg k "agent:$pubkey" '.[$k]')

printf 'BUZZ_RELAY_URL=%s\nBUZZ_PRIVATE_KEY=%s\nBUZZ_AUTH_TAG=%s\n' \
  "$relay" "$private_key" "$auth_tag"