[BUG] iMessage Cowork connector read_imessages fails with chat.db authorization denied despite working from Claude Code CLI

Description

The iMessage Cowork connector's read functions (read_imessages, get_unread_imessages) fail with authorization denied when trying to access ~/Library/Messages/chat.db. The same iMessage plugin works correctly from a Claude Code CLI session on the same machine.

Send functions (send_imessage, search_contacts) work fine from Cowork — only reads are broken.

Environment

• macOS (Sequoia)
• Claude Desktop app with Cowork enabled
• iMessage connector (latest version, post v0.1.11 fix from #32999)
• Full Disk Access granted to: Claude.app, sqlite3, Terminal, iTerm

Steps to Reproduce

1. Enable the iMessage connector in Cowork (Settings → Connectors)
2. In a Cowork session, call read_imessages with any phone number
3. Observe authorization denied error

Error Output

Failed to read messages: Command failed: sqlite3 -json "/Users/alex/Library/Messages/chat.db" "
  SELECT ...
  FROM message m
  INNER JOIN handle h ON h.ROWID = m.handle_id
  WHERE h.id IN ('+1XXXXXXXXXX')
  ...
"
Error: unable to open database "/Users/alex/Library/Messages/chat.db": authorization denied

Expected Behavior

read_imessages should return message data, same as it does from Claude Code CLI.

What I've Tried

• Granted Full Disk Access to Claude.app — no change
• Granted Full Disk Access to /usr/bin/sqlite3 — no change
• Toggled FDA off/on and restarted Claude Desktop — no change
• Confirmed the fix from #32999 (v0.1.11) is installed

Working Comparison

On the same Mac, from a Claude Code CLI session:

• plugin:imessage → chat_messages → works perfectly, returns full message data
• No authorization errors

Analysis

The error trace shows the Cowork connector is still spawning sqlite3 as a subprocess to query chat.db. Since Cowork runs code in an isolated VM environment, the subprocess likely cannot access host-level macOS files regardless of FDA settings. The Claude Code CLI runs directly on the host, which is why it works.

The connector may need to proxy the chat.db query through the host rather than executing it from within the VM sandbox.

Impact

This prevents using the iMessage connector for reading messages in Cowork sessions. Send works, read doesn't — so it's a partial connector failure.