[BUG] Cowork Windows: API unreachable from VM behind corporate NTLM proxy (cntlm)

Bug Description

Cowork VM starts successfully but cannot reach the Anthropic API from inside the VM when the host machine is behind a corporate NTLM-authenticated proxy (cntlm).

The Claude Desktop app itself works fine for regular chat (it uses the Windows system proxy), and Claude Code CLI works fine (runs natively on Windows). Only Cowork's Linux VM fails because it has no awareness of the host's proxy configuration.

Environment

• OS: Windows 11 Enterprise 10.0.22631
• CPU: 11th Gen Intel Core i7-11850H
• RAM: 32 GB
• Claude Desktop version: 1.1.4498 (MSIX)
• Proxy: cntlm on localhost:3128 (NTLM auth to corporate proxy)
• Network: Mercedes-Benz corporate network with NTLM proxy + SSL interception

Steps to Reproduce

1. Install Claude Desktop on a Windows machine behind a corporate NTLM proxy
2. Open Cowork
3. VM downloads bundle files successfully (through the Desktop app's connection)
4. VM boots, guest connects, network shows CONNECTED
5. API reachability immediately shows UNREACHABLE
6. Cowork session fails — cannot send/receive messages

Log Evidence

From cowork_vm_node.log:

06:21:36 [info] [VM] Network status: CONNECTED
06:21:40 [info] [VM:start] Startup complete, total time: 376725ms
06:21:41 [info] [VM] API reachability: PROBABLY_UNREACHABLE
06:22:06 [info] [VM] API reachability: UNREACHABLE
06:22:06 [warn] [VM:network] API is unreachable

The VM successfully starts and the guest connects to the host:

06:21:35 [info] [VM:start] Still waiting for guest connection... 10546ms elapsed, 12 polls
06:21:36 [info] [VM] Network status: CONNECTED

OAuth token is approved with MITM proxy awareness, suggesting some proxy support exists:

06:22:00 [info] [Spawn:vm] OAuth token approved with MITM proxy

But the VM itself cannot egress to the API. Sessions spawn and then get killed after ~3 minutes:

06:22:00 [info] [Spawn:create] id=8fda9b3b ... name=lucid-brave-planck
06:24:58 [info] [CoworkVMProcess:8fda9b3b] kill called with signal: SIGTERM

Expected Behavior

The Cowork VM should either:

1. Inherit the host's proxy settings (detect system proxy / HTTP_PROXY env vars)
2. Allow user-configurable proxy settings for the VM (e.g., in Claude Desktop settings)
3. Route VM traffic through the host's network stack (which already has proxy access)

Workaround

Using Claude Code CLI directly on Windows, which runs natively and uses the system proxy without issues.

Related Issues

• #26258 — Similar API unreachable on Windows, different root cause (Home edition)
• #27283 — CSP + API unreachable on Windows 10 Pro
• #26510 — NAT rule creation failures on Windows 11 Pro

This issue is distinct because the root cause is specifically corporate NTLM proxy — the VM's network connects but cannot egress through the authenticated proxy.