fix(mcp): restore trust+isTrustedFolder permission check in getDefaultPermission

packages/core/src/tools/mcp-tool.test.ts

@@ -736,7 +736,7 @@ describe('DiscoveredMCPTool', () => {
   });
 
   describe('getDefaultPermission and getConfirmationDetails', () => {
-    it('should return ask even if trust is true and folder is trusted (trust logic moved to PM)', async () => {
+    it('should return allow when trust is true', async () => {
       const trustedTool = new DiscoveredMCPTool(
         mockCallableToolInstance,
         serverName,
@@ -748,7 +748,7 @@ describe('DiscoveredMCPTool', () => {
         { isTrustedFolder: () => true } as any,
       );
       const invocation = trustedTool.build({ param: 'mock' });
-      expect(await invocation.getDefaultPermission()).toBe('ask');
+      expect(await invocation.getDefaultPermission()).toBe('allow');
     });
 
     it('should return ask if not trusted', async () => {
@@ -808,7 +808,7 @@ describe('DiscoveredMCPTool', () => {
       isTrustedFolder: () => isTrusted,
     });
 
-    it('should return ask even if trust is true and folder is trusted (trust logic moved to PM)', async () => {
+    it('should return allow when trust is true and folder is trusted', async () => {
       const trustedTool = new DiscoveredMCPTool(
         mockCallableToolInstance,
         serverName,
@@ -820,7 +820,7 @@ describe('DiscoveredMCPTool', () => {
         mockConfig(true) as any, // isTrustedFolder = true
       );
       const invocation = trustedTool.build({ param: 'mock' });
-      expect(await invocation.getDefaultPermission()).toBe('ask');
+      expect(await invocation.getDefaultPermission()).toBe('allow');
     });
 
     it('should return ask if trust is true but folder is not trusted', async () => {

packages/core/src/tools/mcp-tool.ts

@@ -124,14 +124,17 @@ class DiscoveredMCPToolInvocation extends BaseToolInvocation<
   }
 
   /**
-   * MCP tool default permission based on annotations:
+   * MCP tool default permission based on trust and annotations:
+   * - trust: true in a trusted folder → 'allow' (server explicitly trusted by user config)
    * - readOnlyHint → 'allow'
    * - All other MCP tools → 'ask'
-   *
-   * Note: trust/isTrustedFolder logic is now handled by PM rules,
-   * not by getDefaultPermission().
    */
   override async getDefaultPermission(): Promise<PermissionDecision> {
+    // MCP servers explicitly marked as trusted bypass confirmation,
+    // but only when the workspace folder is also trusted (security gate).
+    if (this.trust === true && this.cliConfig?.isTrustedFolder()) {
+      return 'allow';
+    }
     // MCP tools annotated with readOnlyHint: true are safe
     if (this.annotations?.readOnlyHint === true) {
       return 'allow';