fix(hive): restore company VM agents in native channel picker

[100yenadmin]

Closes #39

Installed failure

On cumulative Internal Canary head 820be3cbd139cf716cec5c20390ba40e541e5c99, ATRIS replied in a fresh native DM but native general channel member search returned No matching people or agents for ATRIS.

Change

• expose the tenant-authoritative company catalog key set from the existing relay-agent adapter
• admit the union of local managed-agent keys and verified same-company VM-agent keys in native channel-add search
• keep unrelated/self-declared relay agents excluded
• retain native bot-role membership; no local persona/runtime or Hermes mutation

Focused proof

• agentAutocompleteEligibility.test.mjs: 21/21 pass
• focused eligibility + company catalog tests: 31/31 pass
• desktop TypeScript typecheck: pass
• Biome check on the four changed files: pass

Proof boundary

This is source/focused-test proof only. Exact-head CI, independent semantic review, merge, refreshed cumulative artifact, and installed channel add/mention/remove proof remain separate gates.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f13188e0-7d40-4624-90ff-d11ed2af5ee5

📥 Commits

Reviewing files that changed from the base of the PR and between 820be3c and dcd34b8.

📒 Files selected for processing (4)

• desktop/src/features/agents/lib/agentAutocompleteEligibility.test.mjs
• desktop/src/features/agents/lib/agentAutocompleteEligibility.ts
• desktop/src/features/agents/relayAgentsQuery.ts
• desktop/src/features/channels/ui/MembersSidebar.tsx

---

📝 Walkthrough

Priority Level: P4/NIT

No P0–P3 issues found. The changes correctly combine managed-agent and verified company-agent keys for native channel-add eligibility while preserving bot-role membership and excluding unrelated relay agents. Focused tests cover the admission behavior.

Optional: retain the pending installed-proof and post-merge channel verification to validate the behavior in the deployed environment; this is not required based on the source review.

Walkthrough

The change unifies normalized managed and company agent pubkeys for channel-add eligibility, exposes company pubkeys from the relay-agent query, updates member filtering, and adds coverage for verified company and unrelated relay agents. Confidence: 98%.

Changes

Channel agent eligibility

Layer / File(s)	Summary
Addable agent identity contract desktop/src/features/agents/lib/agentAutocompleteEligibility.ts, desktop/src/features/agents/relayAgentsQuery.ts	Adds a normalized union helper for managed and company agent pubkeys and exposes company pubkeys from useRelayAgentsQuery.
Member candidate filtering desktop/src/features/channels/ui/MembersSidebar.tsx, desktop/src/features/agents/lib/agentAutocompleteEligibility.test.mjs	Uses the unified pubkey set when excluding add candidates and verifies company-agent inclusion versus unrelated relay-agent exclusion.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MembersSidebar
  participant useRelayAgentsQuery
  participant getChannelAddableAgentPubkeys
  participant addCandidate
  useRelayAgentsQuery-->>MembersSidebar: companyAgentPubkeys
  MembersSidebar->>getChannelAddableAgentPubkeys: managedAgentPubkeys and companyAgentPubkeys
  getChannelAddableAgentPubkeys-->>MembersSidebar: normalized addableAgentPubkeys
  MembersSidebar->>addCandidate: exclude identities in addableAgentPubkeys

Loading

Possibly related issues

• Issue 62 — The unified normalized pubkey set directly supports channel-add behavior for company and managed VM agents.

Suggested reviewers: wesbillman

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/39-vm-agent-channel-picker

---

_{Comment @coderabbitai help to get the list of available commands.}

[100yenadmin]

Independent exact-head semantic review: PASS on dcd34b8510b8e4015898a01687a847a961c59b9a.

Coverage:

• tenant authority: the admitted remote key set comes only from the tenant-scoped company catalog, not self-declared relay capabilities;
• channel picker eligibility: verified company VM keys and local managed keys are admitted, unrelated relay agents remain excluded;
• native membership path: remote company agents use the ordinary native add-members mutation with role bot; only local managed backends use local attach/runtime handling;
• focused test adequacy: normalization, catalog admission, and unrelated-key rejection are covered.

Findings: none. No P0/P1 or realistic supported-path P2 blocker. This review proves source semantics on the exact head only; installed proof remains pending after merge in the refreshed cumulative canary.