## Summary
CVE-2026-21518 is a workspace trust bypass in VS Code’s MCP server registry. Workspace-scoped MCP server definitions could be auto-started without prompting for workspace trust, allowing a malicious `.vscode/settings.json` to launch arbitrary commands when a victim opens an untrusted repository. The fix adds an explicit workspace trust check in `McpRegistry._checkTrust` before any workspace-scoped server is started.

## Impact
- Package/component affected: VS Code workbench MCP registry (`src/vs/workbench/contrib/mcp/common/mcpRegistry.ts`)
- Affected versions: prior to 1.109.1 (fix commit `cd11faec7b031b928bc5ec37f350d623ffb28713`)
- Risk level and consequences: Medium. Opening an untrusted repository could start an attacker-controlled MCP server and execute its configured command, bypassing the workspace trust barrier.

## Root Cause
The `_checkTrust` path did not gate workspace-scoped MCP collections on workspace trust. As a result, `resolveConnection()` proceeded to launch even when the workspace was untrusted, allowing execution of the MCP server command. The fix adds a `StorageScope.WORKSPACE` trust check via `IWorkspaceTrustManagementService` and `IWorkspaceTrustRequestService` before running trust logic for MCP servers.

Fix commit: `cd11faec7b031b928bc5ec37f350d623ffb28713`

## Reproduction Steps
1. Run `repro/reproduction_steps.sh`.
2. The script installs build dependencies, bundles a TypeScript harness that exercises `McpRegistry.resolveConnection()` with a workspace-scoped MCP collection, and runs it against the vulnerable and fixed commits.
3. Expected evidence: the vulnerable run reports “workspace-scoped server started without trust”, while the patched run reports “workspace trust check blocked connection”.

## Evidence
- Logs: `logs/vulnerable_run.log`, `logs/patched_run.log`, `logs/summary.log`, `logs/esbuild.log`
- Key excerpts:
  - `logs/vulnerable_run.log`: “Vulnerable behavior observed: workspace-scoped server started without trust.”
  - `logs/patched_run.log`: “Patched behavior observed: workspace trust check blocked connection.”
- Environment: Node.js + npm with local `esbuild` bundling of the VS Code TypeScript sources.

## Recommendations / Next Steps
- Keep the workspace trust gate in `McpRegistry._checkTrust` for all `StorageScope.WORKSPACE` collections.
- Ensure release versions include commit `cd11faec7b031b928bc5ec37f350d623ffb28713` (1.109.1 or later).
- Add/extend automated tests for workspace trust gating of MCP server launch paths.

## Additional Notes
- Idempotency: `repro/reproduction_steps.sh` was run twice successfully with identical outputs.
- Limitation: The harness uses test services to exercise the MCP registry logic directly rather than spinning up a full VS Code UI, but executes the real vulnerable code path from the repository.