[BUG] Cowork VM fails to start on Windows — smol-bin.x64.vhdx has EFS Encrypted attribute, CopyFileW fails

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork VM fails to start on Windows because smol-bin.x64.vhdx in the MSIX package has the NTFS Encrypted (EFS) file attribute. During VM startup, fs.promises.copyFile() calls CopyFileW, which fails with errno -4094 / UV_UNKNOWN when it tries to preserve the encryption attribute at the destination.

The underlying Windows error is: "The specified file could not be encrypted" — CopyFileW cannot write a decrypted copy to a non-encrypted destination directory.

This is a 100% blocker — Cowork cannot start at all. Fresh reinstalls do not fix it because the encrypted attribute is embedded in the MSIX package itself.

What Should Happen?

smol-bin.x64.vhdx should be packaged in the MSIX without the EFS Encrypted attribute so that fs.promises.copyFile() can copy it to the user's AppData directory without error, and the Cowork VM starts successfully.

Error Messages/Logs

UI error banner:
Failed to start Claude's workspace
UNKNOWN: unknown error, copyfile 'C:\Program Files\WindowsApps\Claude_1.1.4498.0_x64__pzs8sxrjxfjjc\app\resources\smol-bin.x64.vhdx' -> 'C:\Users\jones\AppData\Roaming\Claude\vm_bundles\claudevm.bundle\smol-bin.vhdx'

cowork_vm_node.log:
[VM:start] Copying smol-bin.x64.vhdx to bundle: C:\Program Files\WindowsApps\Claude_1.1.4498.0_x64__pzs8sxrjxfjjc\...
[error] [VM:start] Startup failed: Error: UNKNOWN: unknown error, copyfile '...\smol-bin.x64.vhdx' -> '...\smol-bin.vhdx'
    at async Object.copyFile (node:internal/fs/promises:619:10)
    at async e4t (...\app.asar\.vite\build\index.js:722:3162)
  errno: -4094,
  code: 'UNKNOWN',
  syscall: 'copyfile',
  path: 'C:\\Program Files\\WindowsApps\\Claude_1.1.4498.0_x64__pzs8sxrjxfjjc\\app\\resources\\smol-bin.x64.vhdx',
  dest: 'C:\\Users\\jones\\AppData\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\smol-bin.vhdx'

Steps to Reproduce

a1. Install Claude Desktop via the official MSIX installer on Windows 11 Pro

1. Ensure Hyper-V is enabled and vmcompute service is running
2. 3. Open Claude Desktop → switch to Cowork
3. 4. VM startup fails immediately at the smol-bin.x64.vhdx copy step

Root cause confirmed via PowerShell:

Get-Item 'C:\Program Files\WindowsApps\Claude_1.1.4498.0_x64__pzs8sxrjxfjjc\app\resources\smol-bin.x64.vhdx' -Force | Select Attributes
# Output: Archive, Encrypted

The destination directory is NOT encrypted:

cipher "C:\Users\jones\AppData\Roaming\Claude\vm_bundles\claudevm.bundle"
# New files added to this directory will not be encrypted

CopyFileW tries to preserve the EFS encryption attribute at the destination and fails with "The specified file could not be encrypted". Stream-based copy works fine — confirming the file content is intact and the issue is purely the EFS attribute.

Why reinstalls don't fix it: The encrypted attribute is baked into the MSIX package itself. Every reinstall/repair restores the same encrypted file.

Catch-22: Decrypting the source file (takeown + cipher /d) breaks MSIX integrity, after which Windows blocks all access with "The APPX file can not be accessed because it is not encrypted as expected."

Workarounds tried (all failed):

• Fresh reinstall of Claude Desktop (MSIX) → same encrypted file
• - Settings > Apps > Claude > Repair/Reset → file restored but still encrypted
• - - Reset-AppxPackage → did not fix encryption
• - - - Pre-copying file via stream copy → app re-copies unconditionally
• - - - - Encrypting destination directory → source encryption type incompatible
• - - - - - Standalone (.exe) installer's smol-bin.x64.vhdx is NOT encrypted and copies fine, but Cowork rejects it: "requires Claude Desktop to be installed via the Microsoft Store or official MSIX"

Environment:

• Claude Desktop: 1.1.4498.0 (MSIX)
• - OS: Windows 11 Pro, Build 26200.7840
• - - CPU: AMD Ryzen 7 7800X3D (x64)
• - - - Hyper-V: Enabled and functional
• - - - - vmcompute service: Running (Automatic)

Suggested fixes:

• Option A (recommended): Fix the MSIX build pipeline to ensure smol-bin.x64.vhdx is packaged WITHOUT the EFS Encrypted attribute
• - Option B: Replace fs.promises.copyFile() with a stream-based copy in VM startup code
• - - Option C: Use the COPY_FILE_ALLOW_DECRYPTED_DESTINATION (0x8) flag if calling CopyFileW via a native addon

Related issues: #25663, #25206, #25419

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.1.4498.0 (MSIX / Claude Desktop)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_