Local sessions should stay local on wallet connect; add opt-in per-session sync from chat

[zo-sol]

Decision

Connecting a wallet should not auto-sync the device's local (guest) sessions into that wallet's identity. Local sessions stay local and are only synced when the user explicitly chooses to, per session.

Current behavior (to change)

On connect, adoptWallet() calls migrateGuestSessions(connected), which copies every guest session into the connected wallet's store (decrypt with the device key, re-encrypt with the wallet key). So all local chats are silently adopted into whatever wallet is connected — even when the user connected a wallet just to buy one skill.

• surfaces/localhost/src/index.ts — adoptWallet() → migrateGuestSessions()

Proposed

1. Stop auto-migrating on connect. Local sessions keep a Local tag and are never bound to a wallet unless the user opts in.
2. A small sync icon in the chat screen, shown only when: a wallet is connected AND the current session is local. One appropriate placement — not sprinkled around.
3. Tap → confirm flow: show the connected wallet address + that agent's profile, then ask "Sync this session with this agent?" → on confirm, migrate that one session into the wallet's store.
4. Protocol: add a syncSessionToWallet (single session) client message + server handler; reuse the existing migrateGuestSessions machinery scoped to one session.

Rationale

Auto-adopting all local work on connect is presumptuous and surprising. Value-first onboarding means chat/local work exists before any wallet; binding it to an identity should be a deliberate, per-session action with the destination agent shown up front.

Notes

Context from the wallet-connect work (local-wallet unlock + centralized adoptWallet adapters) already in main. This issue tracks the follow-up behavior change + the chat sync UI.

[zo-sol]

One clarification on scope, to make sure we read this the same way (feel free to disagree — not a critical issue either way):

I'm not proposing that all sync becomes manual. Only sessions created before a wallet was connected should stay local and go through the explicit per-session sync.

• Wallet + storage already connected → sessions created from that point sync to that agent automatically, same as today.
• No wallet yet → sessions stay local. When the user connects a wallet later, those pre-existing local sessions are not silently adopted — the user pulls each one in via the sync icon + confirm flow.

flowchart TD
    S[New session created] --> Q{Wallet + storage<br/>connected at creation time?}
    Q -- yes --> A[Auto-sync to that agent<br/>same as today]
    Q -- no --> L[Session tagged Local]
    L --> C[Wallet connected later]
    C --> M[No auto adoption<br/>session keeps Local tag]
    M --> U[User taps sync icon<br/>confirm agent<br/>migrate that one session]

Loading

I think the body already implies this (the proposal only touches guest sessions at connect time), but stating it explicitly since "local sessions stay local" could be misread as "all sync is manual now."