[Cowork] Windows host-loop: `mcp__workspace__bash` denied in every session after Desktop 1.44121.1 / CLI 2.1.258

Environment

• Claude Desktop 1.44121.1 (Microsoft Store / MSIX build), Windows 11 Home 10.0.26200
• Bundled Claude Code CLI 2.1.258 (BUILD_TIME 2026-09-01T21:54:40Z)
• Cowork in host-loop mode (claude.exe on host, shell routed to the VM via mcp__workspace__bash)
• Previous version 1.40609.1 worked normally the same morning

What happens
Since the app stealth-updated at 10:12 PDT on 2026-09-02, every Cowork session (chats and scheduled tasks) gets:

Permission to use mcp__workspace__bash has been denied.

main.log shows zero [workspaceMcpServer] bash: entries after the update; the call is denied inside the CLI before dispatch. Read/Write/Glob still work. The Code tab's built-in Bash is unaffected. No permission prompt is shown, so "approve the prompt" is impossible.

Not caused by local configuration (verified)

• No HKLM|HKCU\SOFTWARE\Policies\Claude, no C:\ProgramData\ClaudeCode\managed-settings.json, configOrgDelivered:false
• Per-session CLAUDE_CONFIG_DIR has no settings.json; --setting-sources=user
• policy-limits carry no tool restrictions; no remembered deny decisions on disk

Session launch arguments (captured from the running process)

--allowedTools ...,mcp__workspace__bash
--disallowedTools Bash,PowerShell,NotebookEdit,REPL,JavaScript,WebFetch
--tools Task,Glob,Grep,Read,Edit,Write,TaskCreate,TaskUpdate,TaskGet,TaskList,TaskStop,WebSearch,Skill,AskUserQuestion,Artifact,ToolSearch
--setting-sources=user --permission-mode bypassPermissions --allow-dangerously-skip-permissions

Likely cause (from reading app.asar and the CLI bundle)

1. Host-loop sessions set toolAliases = {Bash: "mcp__workspace__bash", WebFetch: "mcp__workspace__web_fetch"} and pass the built-in tools on --disallowedTools (cliArg source).
2. After spawn the app re-pushes that same list via applyFlagSettings({permissions: hl(W, allowedAtSpawn)}), where hl returns {allow:[...], deny:[...e.disallowedTools], additionalDirectories:[...]}; syncHostLoopPermissions pushes deny:[...hostLoopDisallowedToolsAtSpawn] again on folder changes. These land as flagSettings rules.
3. CLI 2.1.258 deny matching (bs() → dl()) applies proxyExpansion for every source except cliArg/toolsNarrowing, expanding Bash through toolAliases to mcp__workspace__bash. The pushed flagSettings Bash deny therefore blocks the workspace tool.

Expected
Cowork's own built-in-tool hiding should not be alias-expanded into a deny of the workspace shell; either exempt the host's pushed deny list from alias expansion or filter aliased names out of the pushed deny (as Nc() already does for managed settings).

Impact
All Cowork scheduled tasks that need a shell fail every run.