From 392912098c05f9972443b00dded77f8a4e35f5d3 Mon Sep 17 00:00:00 2001
From: adilburaksen <adilburaksen@gmail.com>
Date: Mon, 1 Jun 2026 14:16:28 +0300
Subject: [PATCH] Use consolidated MCP server lists in the ACP and
 policy-engine paths

---
 packages/cli/src/acp/acpSessionManager.ts | 10 +++++++++-
 packages/cli/src/config/config.ts         | 12 +++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/packages/cli/src/acp/acpSessionManager.ts b/packages/cli/src/acp/acpSessionManager.ts
index cfa7037a24b..a902773547e 100644
--- a/packages/cli/src/acp/acpSessionManager.ts
+++ b/packages/cli/src/acp/acpSessionManager.ts
@@ -330,7 +330,15 @@ export class AcpSessionManager {
       mcpServers: mergedMcpServers,
     };
 
-    const config = await loadCliConfig(settings, sessionId, this.argv, { cwd });
+    const config = await loadCliConfig(settings, sessionId, this.argv, {
+      cwd,
+      // Pass the LoadedSettings so loadCliConfig uses the consolidated (union
+      // of excluded / intersection of allowed) MCP server lists across all
+      // settings scopes, matching the interactive path. Without this, the ACP
+      // path fell back to the raw merged settings, where a workspace
+      // mcp.excluded could REPLACE (drop) a user-level block.
+      loadedSettings: currentSettings,
+    });
 
     createPolicyUpdater(
       config.getPolicyEngine(),
diff --git a/packages/cli/src/config/config.ts b/packages/cli/src/config/config.ts
index 139ab5d0f10..48122373892 100755
--- a/packages/cli/src/config/config.ts
+++ b/packages/cli/src/config/config.ts
@@ -814,7 +814,17 @@ export async function loadCliConfig(
     },
     mcp: {
       ...settings.mcp,
-      allowed: argv.allowedMcpServerNames ?? settings.mcp?.allowed,
+      // Use the consolidated MCP lists (union of excluded across all scopes,
+      // intersection of allowed) for the policy engine, so a workspace-scoped
+      // mcp.excluded cannot drop a user/system block via REPLACE merge.
+      allowed:
+        argv.allowedMcpServerNames ??
+        (loadedSettings
+          ? loadedSettings.getConsolidatedAllowedMcpServers()
+          : settings.mcp?.allowed),
+      excluded: loadedSettings
+        ? loadedSettings.getConsolidatedExcludedMcpServers()
+        : settings.mcp?.excluded,
     },
     policyPaths: (argv.policy ?? settings.policyPaths)?.map((p) =>
       resolvePath(p),