[Bug] Plan mode prompts for allowlisted MCP tools, ignoring permissions.allow and PreToolUse allow hook (regression since 2.1.302) #103919

Bug Description
Plan mode prompts for an allowlisted MCP tool, ignoring permissions.allow and a PreToolUse "allow" hook

Regression: started in 2.1.302. Still happens in 2.1.303 and 2.1.305. Worked in 2.1.274 through 2.1.296.

Setup (user settings.json):

• permissions.allow includes "mcp__cg__cg_run" and "mcp__cg__cg_run_many".
• A PreToolUse hook with matcher "mcp__cg__.*" prints
  {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}.
• defaultMode is "auto".

Steps:

1. Enter plan mode.
2. Have the model call mcp__cg__cg_run (a stdio MCP server tool with no annotations).

Expected: the call runs without a prompt, as it does in auto mode and as it did in plan mode up to 2.1.296.
Actual: a permission prompt appears for every call. "Don't ask again" has no effect, since the rule already exists.

Evidence from transcripts:

• The hook_success attachment with permissionDecision "allow" is logged about 0.5s after each tool_use.
• The tool_result still arrives 2-563s later, while the command itself ran in under 1s.
• Some of these calls were refused by the MCP server instantly, so the wait happened in Claude Code before the server saw the call.
• Plan-mode calls to the same server build, in the same project:
  2.1.274-2.1.296: about 400 calls, nearly all fast. Refusals returned instantly.
  2.1.302: 34 of 34 slow. 2.1.303: 13 of 13 slow. 2.1.305: 16 of 16 slow.
• Auto-mode calls stay fast on every version.

Environment Info

• Platform: darwin
• Terminal: WezTerm
• Version: 2.1.305
• Feedback ID: e7e27c2a-fa44-472e-8850-ff49a2280f1b