Cowork sessions don't inject user_config env vars into MCP server processes

Summary

MCP servers that use user_config in their manifest to receive credentials via environment variables don't get those values in cowork sessions. The env vars are completely absent (not even unresolved template strings).

Reproduction

1. Install an MCP extension with user_config fields (e.g., cellartracker-mcp)
2. Configure credentials via the Claude Desktop extension settings UI
3. Verify credentials work in normal Desktop mode (tools succeed)
4. Start a cowork session
5. Call any tool that requires credentials - fails with "credentials not found"

Expected behavior

user_config values from extension settings JSON are resolved and injected as env vars into the MCP server process, same as in normal Desktop mode.

Actual behavior

Env vars are completely absent. Diagnostic output from inside the cowork VM:

CT_USERNAME=(not set)
CT_PASSWORD=(not set)
HOME=/sessions/zealous-affectionate-ritchie

The extension settings on the host are populated correctly:

~/Library/Application Support/Claude/Claude Extensions Settings/local.mcpb.brad-slavin.cellartracker-mcp.json

Contains valid userConfig with both ct_username and ct_password.

Manifest configuration

The extension's manifest.json declares:

"server": {
  "mcp_config": {
    "env": {
      "CT_USERNAME": "${user_config.ct_username}",
      "CT_PASSWORD": "${user_config.ct_password}"
    }
  }
},
"user_config": {
  "ct_username": { "type": "string", "required": true },
  "ct_password": { "type": "string", "required": true, "sensitive": true }
}

This works correctly in normal Desktop mode. Only cowork sessions fail to resolve these templates.

Impact

Any MCP extension relying on user_config for authentication is broken in cowork sessions. Users must re-enter credentials via tooling at the start of every session, and those credentials are lost when the ephemeral VM session ends.

Workaround

Running setup-credentials (an MCP tool) at the start of each cowork session temporarily fixes it for that session, but credentials are lost when the session ends since the VM filesystem is ephemeral.

Environment

• macOS 15.5 (Darwin 25.3.0)
• Claude Desktop (latest as of 2026-03-25)
• cellartracker-mcp v0.3.1