[BUG] Desktop app injects computer-use MCP (27 tools + ~1.4K-token instruction block) into interactive sessions even when Computer Use is disabled

Environment

• Claude desktop app 1.12603.1 (macOS, Darwin 25.5.0)
• Bundled Claude Code CLI 2.1.170
• Computer Use: disabled in app settings (confirmed working — see evidence 3)

Summary

With Computer Use disabled, every interactive desktop session still gets the computer-use MCP server registered at spawn: 27 mcp__computer-use__* tool names in the deferred-tool list plus the full computer-use MCP instruction block (~1.4K tokens of tier rules, link-safety and financial-action policy). Combined cost is roughly 1.7K tokens of fixed context overhead per session for a feature that is switched off.

Evidence

1. Spawn args ignore the toggle. A session spawned hours after Computer Use was disabled (and after a full app restart) still launches the CLI with --allowedTools mcp__computer-use,..., and the server is live — it accepts request_access calls.
2. The toggle itself works at the grant layer. Calling mcp__computer-use__request_access in that session correctly raised the "enable Computer Use?" dialog; on decline, the tool returned the expected denial. So the disabled state is honored for use, but not for context injection.
3. No local config requests it. Swept ~/.claude.json, claude_desktop_config.json (only ynab), ~/.claude/settings*.json, all installed plugins (hooks/skills/agents/.mcp.json), project .claude/, Claude Extensions, and app Local Storage: zero references to allowedTools or computer-use. The mcp__computer-use string and the allowedTools array construction are present in app.asar — the injection is decided in the app's session-spawn code.
4. Background/headless sessions (scheduled tasks) correctly omit it; interactive sessions always include it regardless of toggle state.

Expected

When Computer Use is disabled, interactive sessions should spawn without the computer-use MCP server — no tool names, no instruction block — the same way headless sessions already do.

Actual

The server, its 27 tool names, and its full instruction block ship in every interactive session's context; only the permission grant respects the toggle.

Impact

~1.7K tokens of dead weight in every interactive session's fixed context, plus a confusing state for users auditing context overhead: the UI reports the feature as disabled/not loaded while the session context demonstrably contains it.