Override Gemini CLI trust with VScode workspace trust when in IDE (#7433)

packages/cli/src/ui/App.test.tsx

@@ -242,6 +242,12 @@ vi.mock('./hooks/useFolderTrust', () => ({
   })),
 }));
 
+vi.mock('./hooks/useIdeTrustListener', () => ({
+  useIdeTrustListener: vi.fn(() => ({
+    needsRestart: false,
+  })),
+}));
+
 vi.mock('./hooks/useLogger', () => ({
   useLogger: vi.fn(() => ({
     getPreviousUserMessages: vi.fn().mockResolvedValue([]),

packages/cli/src/ui/App.tsx

@@ -27,6 +27,7 @@ import { useLoadingIndicator } from './hooks/useLoadingIndicator.js';
 import { useThemeCommand } from './hooks/useThemeCommand.js';
 import { useAuthCommand } from './hooks/useAuthCommand.js';
 import { useFolderTrust } from './hooks/useFolderTrust.js';
+import { useIdeTrustListener } from './hooks/useIdeTrustListener.js';
 import { useEditorSettings } from './hooks/useEditorSettings.js';
 import { useSlashCommandProcessor } from './hooks/slashCommandProcessor.js';
 import { useAutoAcceptIndicator } from './hooks/useAutoAcceptIndicator.js';
@@ -230,6 +231,7 @@ const App = ({ config, settings, startupWarnings = [], version }: AppProps) => {
     IdeContext | undefined
   >();
   const [showEscapePrompt, setShowEscapePrompt] = useState(false);
+  const [showIdeRestartPrompt, setShowIdeRestartPrompt] = useState(false);
   const [isProcessing, setIsProcessing] = useState<boolean>(false);
 
   const {
@@ -304,6 +306,23 @@ const App = ({ config, settings, startupWarnings = [], version }: AppProps) => {
   const { isFolderTrustDialogOpen, handleFolderTrustSelect, isRestarting } =
     useFolderTrust(settings, setIsTrustedFolder);
 
+  const { needsRestart: ideNeedsRestart } = useIdeTrustListener(config);
+  useEffect(() => {
+    if (ideNeedsRestart) {
+      // IDE trust changed, force a restart.
+      setShowIdeRestartPrompt(true);
+    }
+  }, [ideNeedsRestart]);
+
+  useKeypress(
+    (key) => {
+      if (key.name === 'r' || key.name === 'R') {
+        process.exit(0);
+      }
+    },
+    { isActive: showIdeRestartPrompt },
+  );
+
   const {
     isAuthDialogOpen,
     openAuthDialog,
@@ -1102,6 +1121,17 @@ const App = ({ config, settings, startupWarnings = [], version }: AppProps) => {
                 }
               }}
             />
+          ) : showIdeRestartPrompt ? (
+            <Box
+              borderStyle="round"
+              borderColor={Colors.AccentYellow}
+              paddingX={1}
+            >
+              <Text color={Colors.AccentYellow}>
+                Workspace trust has changed. Press &apos;r&apos; to restart
+                Gemini to apply the changes.
+              </Text>
+            </Box>
           ) : isFolderTrustDialogOpen ? (
             <FolderTrustDialog
               onSelect={handleFolderTrustSelect}

packages/cli/src/ui/hooks/useIdeTrustListener.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { useCallback, useEffect, useState, useSyncExternalStore } from 'react';
+import type { Config } from '@google/gemini-cli-core';
+import { ideContext } from '@google/gemini-cli-core';
+
+/**
+ * This hook listens for trust status updates from the IDE companion extension.
+ * It provides the current trust status from the IDE and a flag indicating
+ * if a restart is needed because the trust state has changed.
+ */
+export function useIdeTrustListener(config: Config) {
+  const subscribe = useCallback(
+    (onStoreChange: () => void) => {
+      const ideClient = config.getIdeClient();
+      ideClient.addTrustChangeListener(onStoreChange);
+      return () => {
+        ideClient.removeTrustChangeListener(onStoreChange);
+      };
+    },
+    [config],
+  );
+
+  const getSnapshot = () =>
+    ideContext.getIdeContext()?.workspaceState?.isTrusted;
+
+  const isIdeTrusted = useSyncExternalStore(subscribe, getSnapshot);
+
+  const [needsRestart, setNeedsRestart] = useState(false);
+  const [initialTrustValue] = useState(isIdeTrusted);
+
+  useEffect(() => {
+    if (
+      !needsRestart &&
+      initialTrustValue !== undefined &&
+      initialTrustValue !== isIdeTrusted
+    ) {
+      setNeedsRestart(true);
+    }
+  }, [isIdeTrusted, initialTrustValue, needsRestart]);
+
+  return { isIdeTrusted, needsRestart };
+}