bxcore, loopd: TurnDone says whether the session has read untrusted content

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/loopd/src/channel.rs

@@ -217,6 +217,8 @@ pub fn handle(stream: UnixStream, ctx: Arc<Context>) {
                     msg: Message::TurnDone(TurnDone {
                         content: outcome.content,
                         usage: outcome.usage,
+                        // The whole log, this turn's results included (M5b spec, section 8).
+                        untrusted: session.untrusted(),
                     }),
                 },
             );

crates/loopd/src/session.rs

@@ -193,6 +193,21 @@ impl Session {
         id
     }
 
+    /// True once any tool result in the log is labelled untrusted: a result under an untrusted
+    /// grant, or a recalled memory-tainted note, which `brokerd` labels so. The labels are in
+    /// the log, so this holds after the session is reopened, and it never becomes false again.
+    pub fn untrusted(&self) -> bool {
+        self.records.iter().any(|record| {
+            matches!(
+                record,
+                LogRecord::ToolResult {
+                    untrusted: true,
+                    ..
+                }
+            )
+        })
+    }
+
     pub fn last_usage(&self) -> Option<bxcore::Usage> {
         for record in self.records.iter().rev() {
             if let LogRecord::Usage {