[BUG] Desktop (Linux): regression of #100854, claude-desktop runs with no_new_privs again in 2.37337.1 so links don't open in a Snap browser

Regression of #100854

#100854 was closed on 2026-10-11 after a comment said it was fixed in Claude Desktop 2.31226.1. In 2.37337.1, which is newer, NoNewPrivs is set again on the app's main process and every child process. The running app was started after 2.37337.1 was installed (installed 09:26, started 09:34), so this is not an older process still running.

Summary

On Ubuntu 26.04 with the default snap Firefox, clicking any link in Claude Desktop does nothing. The app's main process runs with NoNewPrivs=1, which every child process inherits, including the xdg-open it uses to open links. Snap apps can't start under that flag, because snap-confine needs its file capabilities and the flag makes the kernel ignore them. So no link can open in a snap browser, which is Ubuntu's default.

Environment

• Claude Desktop: 2.37337.1 (/usr/lib/claude-desktop, .deb)
• OS: Ubuntu 26.04.1 LTS, kernel 6.17.0-1033-oem, Wayland session
• snapd: 2.77.1
• Firefox: 157.0.1-1 (snap, rev 9036), default browser firefox_firefox.desktop

Steps to reproduce

1. On stock Ubuntu with snap Firefox as the default browser, open Claude Desktop.
2. Click any link in a conversation.

Expected: the link opens in Firefox.
Actual: nothing happens. The workaround is right-click → copy link → paste into the browser.

Diagnosis

Running xdg-open https://example.com from a shell inside the app fails with:

snap-confine is packaged without necessary permissions and cannot continue
required permitted capability cap_dac_override not found in current capabilities:
  cap_wake_alarm=i

• snap-confine itself is installed correctly (getcap /usr/lib/snapd/snap-confine lists cap_dac_override,cap_sys_admin,...=p).
• Every claude-desktop process, including the main --startup process, has NoNewPrivs: 1 in /proc/<pid>/status.
• The parent process (systemd --user) has NoNewPrivs: 0, so the flag is turned on by the app or its launch path.
• Starting Firefox from outside the app's process tree works from the same shell: systemd-run --user --collect /snap/bin/firefox <url>.

Suggested fix

Open external links through the XDG desktop portal (org.freedesktop.portal.OpenURI.OpenURI over D-Bus) instead of running xdg-open from the restricted process. The portal runs outside the app and launches the user's default browser. Another option is to run the launch through systemd-run --user, or to fall back to one of these when xdg-open fails.