An agent you register is not shared with your collaborators

Registering an agent stored no visibility flag, and every read treated a missing
flag as shared:

agentPresence() shared: info.shared !== false -> undefined means shared
mention routing agents[h]?.shared !== false || ... -> undefined means shared

So a handle was exposed the moment it was created: every collaborator on every
doc you shared could see it in the agent list and @mention it into work. The
toggle in the UI worked, but it defended a door that was already open — and the
existing test set shared:false explicitly, so it never saw the default.

Absent now means unshared, in both reads, and registration writes the flag down
instead of leaving it to be inferred. Re-registering your own handle keeps the
choice you made before.

This matters because an agent is not a document permission: it runs on your
machine, with your credentials, and does work in your name. Sharing it is a
deliberate act — one click on the toggle that already exists.

Behaviour change: existing handles have no flag stored, so they become unshared
on deploy. Collaborators who @mention someone else's agent today will find it
does not answer until the owner shares it. That is the safe direction, and the
smoke fixture now does exactly what a real owner would do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

client/src/doc.js

@@ -4073,7 +4073,7 @@ async function refreshAgents() {
       row.appendChild(el('span', { class: `dot${a.online ? ' on' : ''} tip-below`, 'data-tip': a.online ? 'Online — the agent is polling for work' : 'Offline — the agent is not polling right now' }))
       const id = el('span', { class: 'agent-id' })
       id.appendChild(el('span', { class: 'handle' }, `@${a.handle}`))
-      id.appendChild(el('span', { class: 'muted owner' }, a.owner + (a.shared === false ? ' · private' : '')))
+      id.appendChild(el('span', { class: 'muted owner' }, a.owner + (a.shared ? '' : ' · private')))
       row.appendChild(id)
       const actions = el('span', { class: 'actions' })
       const copy = el('button', { class: 'iconbtn', 'data-tip': 'Copy the agent prompt (paste it into your coding agent)' })

server/api.js

@@ -424,6 +424,10 @@ export function apiRouter() {
       owner: req.user.username,
       createdAt: agents[handle]?.createdAt || Date.now(),
       keyHash: store.hashAgentKey(key),
+      // your agent runs on your machine with your credentials: nobody else's
+      // mentions reach it until you deliberately share it. Re-registering your
+      // own handle keeps whatever you chose before.
+      shared: agents[handle]?.shared === true,
     }
     store.saveAgents(agents)
     res.json({ ok: true, handle, key })

server/collab.js

@@ -334,10 +334,11 @@ function scanDocForMentions(docName, document) {
       const key = `${docName}:${threadId}:${msg.id}`
       if (mentionState.processed[key]) return
       mentionState.processed[key] = true
-      // an agent only receives work for docs its owner can access, and a
-      // PRIVATE agent only answers mentions written by its owner
+      // an agent only receives work for docs its owner can access, and an
+      // UNSHARED agent only answers mentions written by its owner. Sharing is
+      // opt-in: a handle with no flag stored has never been shared.
       const usable = h =>
-        store.canAccessDoc(docName, agents[h]?.owner) && (agents[h]?.shared !== false || agents[h]?.owner === msg.author)
+        store.canAccessDoc(docName, agents[h]?.owner) && (agents[h]?.shared === true || agents[h]?.owner === msg.author)
       const explicit = explicitHandles(msg.text)
       let handles = explicit.filter(usable)
       let implicit = false
@@ -632,7 +633,7 @@ export function agentPresence() {
     return {
       handle,
       owner: info.owner,
-      shared: info.shared !== false,
+      shared: info.shared === true,
       online: hasWaiter || Date.now() - last < 70 * 1000,
       last_seen: last || null,
     }

test/smoke.js

@@ -195,6 +195,11 @@ async function main() {
   const steal = await api('dev:alice', '/api/agents', { method: 'POST', body: { handle: 'test-agent' } })
   assert.ok(steal.error, 'cannot steal a handle')
 
+  // a new handle is unshared, so bob must share it before alice's mentions can
+  // reach it — the rest of this suite drives it as alice, a collaborator
+  const shareAgent = await api('dev:bob', '/api/agents/test-agent/visibility', { method: 'POST', body: { shared: true } })
+  assert.equal(shareAgent.shared, true, 'fixture agent shared with collaborators: ' + JSON.stringify(shareAgent))
+
   // agent keys are agents, not humans
   const agentDoc = await api(KEY, '/api/docs', { method: 'POST', body: { title: 'nope' } })
   assert.ok(agentDoc.error, 'agent key cannot create docs')
@@ -752,6 +757,46 @@ async function main() {
   await api('dev:alice', `/api/docs/${pgw.id}`, { method: 'DELETE' })
   console.log('✓ playground: seed, reset restores state, creator-only')
 
+  // 11e-bis. a BRAND NEW agent is unshared: the old code stored no flag and every
+  // read treated "no flag" as shared, so registering an agent quietly exposed it
+  // to every collaborator on every doc you share
+  {
+    const fresh = await api('dev:bob', '/api/agents', { method: 'POST', body: { handle: 'fresh-agent' } })
+    assert.ok(fresh.key, 'registered: ' + JSON.stringify(fresh))
+    const seenByOwner = await api('dev:bob', `/api/agents?doc=${docId}`)
+    const seenByOther = await api('dev:alice', `/api/agents?doc=${docId}`)
+    assert.ok(seenByOwner.agents.some(a => a.handle === 'fresh-agent' && a.shared === false), 'owner sees it, marked unshared')
+    assert.ok(!seenByOther.agents.some(a => a.handle === 'fresh-agent'), 'a collaborator cannot see a newly registered agent')
+
+    // and a collaborator's mention must not reach it
+    const freshThread = 'thf-' + Math.random().toString(36).slice(2, 8)
+    alice.doc.transact(() => {
+      const messages = new Y.Array()
+      messages.push([{ id: 'freshmsg1', author: 'alice', authorType: 'user', text: '@fresh-agent default-privacy check', ts: Date.now() }])
+      const t = new Y.Map()
+      t.set('anchorStart', anchorStart)
+      t.set('anchorEnd', anchorEnd)
+      t.set('resolved', false)
+      t.set('messages', messages)
+      alice.doc.getMap('threads').set(freshThread, t)
+    })
+    await new Promise(r => setTimeout(r, 1200))
+    const snapFresh = await api(fresh.key, '/api/mentions')
+    assert.ok(!(snapFresh.mentions || []).some(m => m.instruction?.includes('default-privacy check')), 'no work queued from a collaborator: ' + JSON.stringify(snapFresh.mentions))
+
+    // sharing is the deliberate act, and it works
+    const shareIt = await api('dev:bob', '/api/agents/fresh-agent/visibility', { method: 'POST', body: { shared: true } })
+    assert.equal(shareIt.shared, true, 'owner shared it')
+    const nowSeen = await api('dev:alice', `/api/agents?doc=${docId}`)
+    assert.ok(nowSeen.agents.some(a => a.handle === 'fresh-agent'), 'shared agent becomes visible')
+    alice.doc.transact(() => {
+      alice.doc.getMap('threads').get(freshThread).get('messages').push([{ id: 'freshmsg2', author: 'alice', authorType: 'user', text: '@fresh-agent now that it is shared', ts: Date.now() }])
+    })
+    await waitFor(async () => ((await api(fresh.key, '/api/mentions')).mentions || []).some(m => m.instruction?.includes('now that it is shared')), 'a shared agent does receive collaborator mentions')
+    await api('dev:bob', '/api/agents/fresh-agent', { method: 'DELETE' })
+    console.log('✓ a new agent is unshared until its owner shares it')
+  }
+
   // 11f. private agents: only the owner's mentions reach them
   const visPriv = await api('dev:bob', '/api/agents/test-agent/visibility', { method: 'POST', body: { shared: false } })
   assert.equal(visPriv.shared, false, 'owner made agent private')