[BUG] Cowork (Windows): every mcp__workspace__bash call denied "by rule" since Desktop 1.44121.1 / Claude Code 2.1.258 — --disallowedTools Bash now propagates to the aliased Cowork tool

Environment

• Claude Desktop 1.44121.1 (MSIX, C:\Program Files\WindowsApps\Claude_1.44121.1.0_x64__…), installed 2026-09-02 15:19 local
• Bundled Claude Code 2.1.258 (%APPDATA%\Claude\claude-code\2.1.258\claude.exe, cli_binary_source: required_version), installed 2026-09-02 15:44
• Windows 11 Pro 22000, CoworkVMService running, VM status ready
• Previous bundle 2.1.255 worked the same day (session 12:08: 16 successful bash calls)

Symptom

Since 2026-09-02 15:51 local, every mcp__workspace__bash call in every Cowork session is refused without a prompt:

Permission to use mcp__workspace__bash has been denied.

audit.jsonl:

{"type":"system","subtype":"permission_denied","tool_name":"mcp__workspace__bash","decision_reason_type":"rule", ...}
"tool_result_meta":[{"non_execution_kind":"permission-rule"}]

Happens in permission modes auto, default (Manual) and in sessions that previously ran in bypassPermissions. File tools, Obsidian MCP and other MCP tools keep working. Last successful run in %LOCALAPPDATA%\Claude\Logs\main.log: 15:30:24 [workspaceMcpServer] bash done: exit=0.

What I ruled out

• No deny rules in ~/.claude/settings.json, settings.local.json, session outputs/.claude/settings.local.json, or ~/.claude.json
• No C:\ProgramData\ClaudeCode\managed-settings.json, no HKLM/HKCU\SOFTWARE\Policies\{ClaudeCode,Anthropic,Claude}
• cowork-policy-limits-cache.json only contains enforce_web_search_mcp_isolation
• No Desktop setting that toggles shell access (searched de-DE.json strings)

Root cause (as far as I can see)

The Desktop app spawns the CLI with (from Win32_Process.CommandLine):

--disallowedTools Bash,PowerShell,NotebookEdit,REPL,JavaScript,WebFetch
--allowedTools …,mcp__workspace__bash
--tools Task,Glob,Grep,Read,Edit,Write,…

plus tool aliases Bash → mcp__workspace__bash, WebFetch → mcp__workspace__web_fetch.

The permissions docs now state: "Claude Code also applies deny rules that name the whole Bash or WebFetch tool to these Cowork tools … Allow rules don't carry over." With 2.1.258 that propagation apparently applies to the --disallowedTools Bash entry the Desktop app itself passes, so the app's own deny beats its own allow and the aliased tool is dead. Same for mcp__workspace__web_fetch.

Expected

--disallowedTools Bash (meant to hide the built-in Bash because it is aliased) must not deny the aliased Cowork tool that the same command line explicitly allows.

Workaround

None found on the user side. Using the Code tab / Claude Code CLI instead of Cowork for anything that needs a shell.