Sync trust mode on chat resume #426

Restore the per-chat trust toggle on `chat/open` and the `/resume`
slash command by emitting `config/updated` with a new `selectTrust`
field reflecting the resumed chat's persisted `:trust`. Previously
the server kept the persisted `:trust true` (so tool calls
auto-approved) while the client UI silently defaulted to shield-off,
leaving them out of sync and requiring two clicks of the indicator
to reach a real secured state.

Closes #426

🤖 Generated with [eca](https://eca.dev)

Co-Authored-By: eca-agent <git@eca.dev>

Author: ericdallo

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## Unreleased
 
 - Add support for gpt-5.5 variants
+- Restore trust mode on chat resume: `chat/open` and the `/resume` slash command now emit `config/updated` with `selectTrust` reflecting the resumed chat's persisted trust toggle, so the client indicator stays in sync with the server's auto-approval behavior. #426
 
 ## 0.129.1
 

docs/protocol.md

@@ -1824,9 +1824,11 @@ in the UI. The server replays the chat by emitting `chat/cleared` (messages),
 the persisted messages. When the persisted chat has a stored model the server
 additionally emits a `config/updated` notification to realign the client's
 selected model (and available variants) with the resumed chat, so the next
-prompt keeps using the chat's original provider/model. Typically used after
-`chat/list` when the user selects a chat that has not been opened in the current
-client session.
+prompt keeps using the chat's original provider/model. The same notification
+also carries `selectTrust` reflecting the resumed chat's trust toggle, so the
+client indicator stays in sync with the auto-approval behavior the server will
+apply. Typically used after `chat/list` when the user selects a chat that has
+not been opened in the current client session.
 
 _Request:_
 
@@ -2300,6 +2302,17 @@ interface ConfigUpdatedParams {
          */
         selectVariant?: string | null;
 
+        /**
+         * The trust toggle state for the active chat. When present clients
+         * should forcefully update the chat trust indicator (and any
+         * derived UI like a shield/flame icon) to match this value.
+         *
+         * Server returns this on chat resume (`chat/open`, `/resume`) so the
+         * client's indicator matches the auto-approval behavior the server
+         * will apply for subsequent tool calls in the resumed chat.
+         */
+        selectTrust?: boolean;
+
         /**
         * Message to show when starting a new chat.
         */

src/eca/config.clj

@@ -679,6 +679,19 @@
        messenger
        db*))))
 
+(defn notify-selected-trust-changed!
+  "Server-initiated equivalent of a client-side trust toggle: aligns the
+   client-side trust indicator with the chat's persisted `:trust` value.
+   Emits via `notify-fields-changed-only!`, so it is a no-op when nothing
+   changed. Used by chat resume flows (`chat/open`, `/resume`) so the icon
+   the client shows matches the auto-approval behavior the server is about
+   to apply (#426)."
+  [trust db* messenger]
+  (notify-fields-changed-only!
+   {:chat {:select-trust (boolean trust)}}
+   messenger
+   db*))
+
 (def ^:private config-schema-url "https://eca.dev/config.json")
 
 (defn ^:private flatten-to-paths

src/eca/features/chat.clj

@@ -1479,4 +1479,5 @@
         (send-chat-contents! messages chat-ctx)
         (lifecycle/send-content! chat-ctx :system (assoc-some {:type :metadata} :title title))
         (config/notify-selected-model-changed! (:model chat) db* messenger config)
+        (config/notify-selected-trust-changed! (:trust chat) db* messenger)
         {:found? true :chat-id chat-id :title title}))))

src/eca/features/commands.clj

@@ -482,6 +482,10 @@
                      ;; Align the client's selected model with the resumed chat
                      ;; so the LLM call keeps using the chat's original model. #417
                      (config/notify-selected-model-changed! (:model chat) db* messenger config)
+                     ;; Align the client's trust indicator with the resumed
+                     ;; chat's persisted :trust so the icon matches the
+                     ;; auto-approval behavior the server will apply. #426
+                     (config/notify-selected-trust-changed! (:trust chat) db* messenger)
                      {:type :chat-messages
                       :clear-before? true
                       :chats {chat-id {:title (:title chat)

test/eca/features/chat_test.clj

@@ -1163,19 +1163,21 @@
         (is (match? {:found? true :chat-id chat-id :title "My Opus thread"} result))
         (is (match? {:config-updated [{:chat {:select-model "anthropic/claude-opus-4"
                                               :variants []
-                                              :select-variant nil}}]}
+                                              :select-variant nil}}
+                                      {:chat {:select-trust false}}]}
                     (h/messages))))))
 
-  (testing "Opening a chat with no stored :model does not emit config/updated"
+  (testing "Opening a chat with no stored :model only emits trust config/updated"
     (h/reset-components!)
     (let [chat-id "no-model"]
       (swap! (h/db*) assoc-in [:chats chat-id]
              {:id chat-id
               :messages [{:role "user" :content [{:type :text :text "hi"}]}]})
       (f.chat/open-chat! {:chat-id chat-id} (h/db*) (h/messenger) (h/config))
-      (is (nil? (:config-updated (h/messages))))))
+      (is (match? {:config-updated [{:chat {:select-trust false}}]}
+                  (h/messages)))))
 
-  (testing "Opening a chat with a stale stored :model does not emit config/updated"
+  (testing "Opening a chat with a stale stored :model only emits trust config/updated"
     (h/reset-components!)
     (let [chat-id "stale-model"]
       ;; Opus not in (:models db), so the UI dropdown must not jump to a ghost.
@@ -1184,6 +1186,44 @@
               :model "anthropic/claude-opus-4"
               :messages [{:role "user" :content [{:type :text :text "hi"}]}]})
       (f.chat/open-chat! {:chat-id chat-id} (h/db*) (h/messenger) (h/config))
-      (is (nil? (:config-updated (h/messages)))))))
+      (is (match? {:config-updated [{:chat {:select-trust false}}]}
+                  (h/messages))))))
+
+(deftest open-chat-restores-selected-trust-test
+  (testing "Opening a trusted chat emits config/updated select-trust true (#426)"
+    (h/reset-components!)
+    (let [chat-id "trusted"]
+      (swap! (h/db*) assoc-in [:chats chat-id]
+             {:id chat-id
+              :title "YOLO thread"
+              :trust true
+              :messages [{:role "user" :content [{:type :text :text "hi"}]}]})
+      (f.chat/open-chat! {:chat-id chat-id} (h/db*) (h/messenger) (h/config))
+      (is (match? {:config-updated [{:chat {:select-trust true}}]}
+                  (h/messages)))))
+
+  (testing "Opening a non-trusted chat emits config/updated select-trust false (#426)"
+    (h/reset-components!)
+    (let [chat-id "secured"]
+      ;; Pre-seed last-config-notified so the diff actually picks up false.
+      (swap! (h/db*) assoc :last-config-notified {:chat {:select-trust true}})
+      (swap! (h/db*) assoc-in [:chats chat-id]
+             {:id chat-id
+              :trust false
+              :messages [{:role "user" :content [{:type :text :text "hi"}]}]})
+      (f.chat/open-chat! {:chat-id chat-id} (h/db*) (h/messenger) (h/config))
+      (is (match? {:config-updated [{:chat {:select-trust false}}]}
+                  (h/messages)))))
+
+  (testing "Opening a chat with no :trust key normalizes to false (#426)"
+    (h/reset-components!)
+    (let [chat-id "legacy"]
+      (swap! (h/db*) assoc :last-config-notified {:chat {:select-trust true}})
+      (swap! (h/db*) assoc-in [:chats chat-id]
+             {:id chat-id
+              :messages [{:role "user" :content [{:type :text :text "hi"}]}]})
+      (f.chat/open-chat! {:chat-id chat-id} (h/db*) (h/messenger) (h/config))
+      (is (match? {:config-updated [{:chat {:select-trust false}}]}
+                  (h/messages))))))