[BUG] Cowork Windows: API unreachable behind corporate proxy — regression from working state (was working until Feb 26, 2026)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

[BUG] Cowork Windows: API unreachable behind corporate proxy — regression from working state (was working until Feb 26, 2026)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork VM starts successfully and connects to the network, but the API reachability check consistently fails with UNREACHABLE when behind a corporate HTTP proxy. This is a regression — Cowork was working correctly with the same proxy configuration until February 26, 2026.

Key Evidence of Regression

The cowork_vm_node.log shows that MITM proxy authentication was working successfully until Feb 26, 2026:

2026-02-26 16:36:03 [info] [Spawn:vm] id=... OAuth token approved with MITM proxy
2026-02-26 16:37:20 [info] [Spawn:vm] id=... OAuth token approved with MITM proxy
...
2026-02-26 17:04:14 [info] [Spawn:vm] id=... OAuth token approved with MITM proxy

After this date, all Cowork attempts fail with API unreachable, while the MITM proxy is still detected:

2026-03-13 19:25:03 [info] [Spawn:vm] id=... OAuth token approved with MITM proxy

But the API reachability check fails every time:

2026-03-13 20:01:03 [info] [VM] Network status: CONNECTED
2026-03-13 20:01:08 [info] [VM] API reachability: PROBABLY_UNREACHABLE
2026-03-13 20:01:36 [info] [VM] API reachability: UNREACHABLE
2026-03-13 20:01:36 [warn] [VM:network] API is unreachable

What Works vs. What Doesn't

| Feature | Status | Notes |
|---------|--------|-------|
| Chat tab | ✅ Works | Uses system proxy correctly |
| Cowork tab | ❌ Broken | VM cannot reach API through proxy |
| Code tab | ✅ Works | Runs natively on Windows, uses proxy env vars |

Additional Evidence from main.log

Starting March 9, 2026, main.log began showing ERR_PROXY_CONNECTION_FAILED errors for various services:

2026-03-09 16:12:40 [error] [growthbook] fetch failed: Error: net::ERR_PROXY_CONNECTION_FAILED
2026-03-09 16:12:40 [error] [SkillsPlugin] Sync failed: net::ERR_PROXY_CONNECTION_FAILED
2026-03-10 18:03:35 [error] Failed to fetch blocklist: Error: net::ERR_PROXY_CONNECTION_FAILED
2026-03-11 12:49:02 [error] [growthbook] fetch failed: Error: net::ERR_PROXY_CONNECTION_FAILED

However, the main app itself can still reach the API (updates, blocklist checks, etc. succeed in later entries), confirming the issue is specifically with how the VM accesses the proxy.

Environment

• OS: Windows 11 (x64)
• Claude Desktop: v1.1.6452 (5afc23), MSIX package
• Proxy: Corporate HTTP proxy (non-NTLM, TLS inspection with Let's Encrypt — NOT custom CA)
• VPN: Always-on corporate VPN (forces all traffic through tunnel)
• Proxy config: User environment variables (HTTP_PROXY, HTTPS_PROXY) + IE proxy settings
• Network: Corporate network requiring proxy for all external access (direct connections blocked by firewall)
• Hyper-V/VM Platform: Enabled, CoworkVMService running
• Firewall: Claude allowed (both inbound and outbound)
• HNS Network: Get-HnsNetwork returns empty (no cowork-vm-nat)

VM Startup Log (Full Cycle)

2026-03-13 20:00:41 [info] [VM] Loading vmClient (TypeScript) module...
2026-03-13 20:00:41 [info] [VM] Module loaded successfully
2026-03-13 20:00:50 [info] [KernelBugMonitor] State reset
2026-03-13 20:00:50 [info] [VM:start] Beginning startup
2026-03-13 20:00:50 [info] [VM:start] Bundle version: fb30784dadb34104626c8cf6d8f90dd47cd393cc
2026-03-13 20:00:50 [info] [VM:steps] download_and_sdk_prepare started
2026-03-13 20:00:50 [info] [VM:steps] download_and_sdk_prepare completed (29ms)
2026-03-13 20:00:50 [info] [VM:steps] load_swift_api completed (0ms)
2026-03-13 20:00:50 [info] [VM:start] Copying smol-bin.x64.vhdx to bundle
2026-03-13 20:00:50 [info] [VM:start] smol-bin.x64.vhdx copied successfully
2026-03-13 20:00:50 [info] [VM:start] Configuring Windows VM service...
2026-03-13 20:00:51 [info] [VM:start] Windows VM service configured
2026-03-13 20:01:03 [info] [VM] Network status: CONNECTED
2026-03-13 20:01:03 [info] [VM:steps] sdk_install started
2026-03-13 20:01:03 [info] [postConnect] Installing SDK: version=2.1.72
2026-03-13 20:01:06 [info] [Keepalive] Starting (interval=2000ms)
2026-03-13 20:01:06 [info] [VM:steps] sdk_install completed (2703ms)
2026-03-13 20:01:06 [info] [VM:start] Startup complete, total time: 16125ms
2026-03-13 20:01:08 [info] [VM] API reachability: PROBABLY_UNREACHABLE
2026-03-13 20:01:36 [info] [VM] API reachability: UNREACHABLE
2026-03-13 20:01:36 [warn] [VM:network] API is unreachable

Steps to Reproduce

1. Install Claude Desktop v1.1.6452 on Windows with corporate HTTP proxy
2. Configure HTTP_PROXY and HTTPS_PROXY environment variables
3. Connect through always-on corporate VPN
4. Open Claude Desktop — Chat tab works fine
5. Switch to Cowork tab
6. VM boots, network connects, SDK installs — but API reachability fails
7. Error: "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace"

Expected Behavior

Cowork VM should use the host's proxy configuration to reach api.anthropic.com, as it did successfully before Feb 26, 2026.

Troubleshooting Attempted

• ✅ Restarted Claude Desktop and PC multiple times
• ✅ Restarted CoworkVMService (Restart-Service CoworkVMService -Force)
• ✅ Deleted and rebuilt VM (vm_bundles and claude-code-vm folders) — Cowork started once but API remained unreachable
• ✅ Verified proxy server is reachable from host — success
• ✅ Verified firewall allows Claude (inbound + outbound)
• ✅ Confirmed host cannot reach api.anthropic.com directly (proxy required, direct connections blocked)
• ✅ Without proxy + VPN, Cowork works — proving the issue is specifically proxy-related
• ✅ Code tab works with proxy (runs natively, not in VM)
• ✅ Attempted static route to bypass VPN for Anthropic IPs — VPN captures all traffic regardless

Related Issues

• #29367 — API unreachable from VM behind corporate NTLM proxy (cntlm)
• #26953 — Cowork VM API unreachable with MITM proxy
• #25944 — API unreachable, MITM proxy not binding to VM gateway
• #24945 — VM boots but API unreachable on Windows 11

Impact

This regression blocks all Cowork usage for users on corporate networks that require proxy access. The Code tab works as a partial workaround, but lacks Cowork's task management UI and scheduled tasks functionality.

What Should Happen?

Cowork VM should use the host's proxy configuration to reach api.anthropic.com, as it did successfully before Feb 26, 2026.

Error Messages/Logs

2026-03-13 20:01:03 [info] [VM] Network status: CONNECTED
2026-03-13 20:01:08 [info] [VM] API reachability: PROBABLY_UNREACHABLE
2026-03-13 20:01:36 [info] [VM] API reachability: UNREACHABLE
2026-03-13 20:01:36 [warn] [VM:network] API is unreachable

Steps to Reproduce

1. Install Claude Desktop v1.1.6452 (MSIX) on Windows 11
2. Configure corporate HTTP proxy via environment variables (HTTP_PROXY, HTTPS_PROXY)
3. Connect through always-on corporate VPN
4. Open Claude Desktop — Chat tab works fine
5. Switch to Cowork tab
6. VM boots, network connects (CONNECTED), SDK installs successfully
7. API reachability check fails: PROBABLY_UNREACHABLE → UNREACHABLE
8. Error: "Failed to start Claude's workspace — Can't reach the Claude API from Claude's workspace"

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown (worked on Feb 26, 2026)

Claude Code Version

2.1.72 (Claude Desktop v1.1.6452)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_