MCP destructive tools silently denied without prompt in acceptEdits mode — misleading error message

Summary

When Claude Code is in acceptEdits permission mode, calling a destructive MCP tool (e.g. delete-many on a MongoDB MCP server) that is not in permissions.allow results in a silent denial with no user-facing prompt. The error returned to the model says "User did not confirm the execution" — which is misleading because the user never saw any confirmation dialog.

Steps to Reproduce

1. Set defaultMode: "acceptEdits" in ~/.claude/settings.json
2. Have a destructive MCP tool available (e.g. mcp__mongo-prod-MC-MetaData__delete-many) that is NOT in permissions.allow
3. Ask Claude to invoke that tool
4. Observe: no prompt appears, tool is silently denied

Expected Behavior

Either:

• A confirmation prompt is shown to the user (consistent with the mode name "acceptEdits" which implies non-edit tools are prompted)
• OR a clear error message is shown: "Tool not permitted — add <tool-name> to permissions.allow to enable it"

Actual Behavior

• No prompt is shown to the user
• Claude receives the error: "User did not confirm the execution of the <tool> tool so the operation was not performed"
• This message incorrectly implies the user actively denied the tool, when in fact the system auto-denied it silently

Additional Notes

• Switching to "ask before edits" mode mid-session also does not surface a prompt for these tools
• Adding the tool to permissions.allow in settings.json mid-session does not take effect until a full session restart (no hot-reload)
• The combination of these behaviors makes it impossible to run a legitimately-approved destructive MCP operation within a session without restarting

Environment

• Claude Code VSCode extension
• defaultMode: "acceptEdits"
• macOS Darwin 25.4.0