From e165eaf3a65adcd67b890182a80face59827e865 Mon Sep 17 00:00:00 2001
From: prxnvt <53838599+prxnvt@users.noreply.github.com>
Date: Wed, 21 Oct 2026 15:18:15 -0400
Subject: [PATCH] Engine: a linked paste of values from a file carries the
 file's trust

A linked paste writes formulas even when it pastes values, but the values exception skipped the trust update, so a Local workbook stayed Local after linking to a FromFile one. The exception now applies only to unlinked pastes.
---
 crates/engine/src/cmd/edit.rs    | 6 ++++--
 crates/engine/src/tests/seams.rs | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/crates/engine/src/cmd/edit.rs b/crates/engine/src/cmd/edit.rs
index 496ca811a..018dd2991 100644
--- a/crates/engine/src/cmd/edit.rs
+++ b/crates/engine/src/cmd/edit.rs
@@ -1184,8 +1184,10 @@ fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
         Ok(())
     })?;
     // Formulas, formats (conditional formats hold formulas) and validation from an untrusted file
-    // leave the destination untrusted; plain values, column widths and notes carry nothing active.
-    if !same_doc && !matches!(what, What::Values | What::ValuesAndNumberFormats | What::ColumnWidths | What::Comments) {
+    // leave the destination untrusted; plain values, column widths and notes carry nothing active
+    // (a linked paste of values still writes formulas).
+    let passive = matches!(what, What::ColumnWidths | What::Comments) || (!link && matches!(what, What::Values | What::ValuesAndNumberFormats));
+    if !same_doc && !passive {
         let d = s.doc_mut()?;
         d.trust = d.trust.receive(clip.trust);
     }
diff --git a/crates/engine/src/tests/seams.rs b/crates/engine/src/tests/seams.rs
index 55c35d76c..cc082258e 100644
--- a/crates/engine/src/tests/seams.rs
+++ b/crates/engine/src/tests/seams.rs
@@ -336,6 +336,10 @@ fn pasting_from_a_file_carries_its_trust() {
     // Values carry nothing that runs.
     s.execute("edit.pasteSpecial", json!({"what": "values", "at": "B1"})).unwrap();
     assert_eq!(trust(&s), Trust::Local);
+    // A linked paste of values still writes formulas.
+    s.execute("edit.pasteSpecial", json!({"what": "values", "link": true, "at": "B2"})).unwrap();
+    assert_eq!(trust(&s), Trust::FromFile);
+    s.new_workbook();
     s.execute("edit.paste", json!({"at": "C1"})).unwrap();
     assert_eq!(trust(&s), Trust::FromFile);
     assert_eq!(v(&s, "C1").display(), "2");