Security: claude CLI invocation silently rewritten to add --resume + computer-use permissions

Summary

A claude CLI process launched via a shell script was substituted, before running, with a different invocation that added full computer-use (mouse/keyboard/screen) permissions and resumed an existing session — neither of which the launching script requested. This happened on a Mac also running the Claude Desktop app. Root cause unknown; requesting investigation.

Environment

• macOS (Darwin 25.6.0)
• Claude Code CLI installed via nvm (~/.nvm/versions/node/v20.20.2/bin/claude)
• Claude Desktop app also running concurrently (app version 2.2553.1), whose own process reports computerUse: supported in its internal feature flags

What was run

A shell script (a user-authored Claude Code Stop hook) executed, via osascript opening a new Terminal.app window:

cd <project-dir> && claude "<a short text prompt>"

What actually launched instead (observed via ps aux)

claude --resume <session-id> --permission-mode default --allowed-tools mcp__computer-use__*

Impact

• The resumed session had full computer-use tool access (mouse/keyboard/screen control), which was never requested by the launching command or by the user.
• Real cost was incurred as a result: $0.75, confirmed from that session's own transcript.

What was ruled out

• No shell alias or wrapper on claude (checked .zshrc, .bashrc, .bash_profile, .zprofile, type claude, which -a claude).
• No environment-variable difference: env | grep -i claude and type claude were byte-identical in a fresh Terminal window whether Claude Desktop was running or fully quit.
• A subsequent minimal, deliberate test (claude -p "..." --max-turns 1 launched the same way, via osascript → Terminal.app, with Claude Desktop fully quit) ran as a plain process with no escalation — so the substitution did not reproduce under that specific narrower condition, but it did happen once, for real, unprompted, during actual normal use.

Question

Is there a mechanism (a Claude Desktop integration, a session-continuity/"resume" heuristic in the CLI, or something else) that can intercept or rewrite a locally-launched claude invocation and attach computer-use permissions to it? If so, under what conditions does it trigger, and can it be disabled entirely? If this is not an intended/known mechanism, this may be a security issue and should be treated as one until ruled out.

Session/log details available on request.