feat(cli): secure .env loading and enforce workspace trust in headless mode (#25814)

Co-authored-by: galz10 <galzahavi@google.com>
Co-authored-by: davidapierce <davidapierce@google.com>

packages/cli/src/utils/userStartupWarnings.ts

@@ -12,6 +12,8 @@ import {
   getCompatibilityWarnings,
   WarningPriority,
   type StartupWarning,
+  isHeadlessMode,
+  FatalUntrustedWorkspaceError,
 } from '@google/gemini-cli-core';
 import type { Settings } from '../config/settingsSchema.js';
 import {
@@ -79,10 +81,34 @@ const rootDirectoryCheck: WarningCheck = {
   },
 };
 
+const folderTrustCheck: WarningCheck = {
+  id: 'folder-trust',
+  priority: WarningPriority.High,
+  check: async (workspaceRoot: string, settings: Settings) => {
+    if (!isFolderTrustEnabled(settings)) {
+      return null;
+    }
+
+    const { isTrusted } = isWorkspaceTrusted(settings, workspaceRoot);
+    if (isTrusted === true) {
+      return null;
+    }
+
+    if (isHeadlessMode()) {
+      throw new FatalUntrustedWorkspaceError(
+        'Gemini CLI is not running in a trusted directory. To proceed, either use `--skip-trust`, set the `GEMINI_CLI_TRUST_WORKSPACE=true` environment variable, or trust this directory in interactive mode.',
+      );
+    }
+
+    return null;
+  },
+};
+
 // All warning checks
 const WARNING_CHECKS: readonly WarningCheck[] = [
   homeDirectoryCheck,
   rootDirectoryCheck,
+  folderTrustCheck,
 ];
 
 export async function getUserStartupWarnings(