[BUG] Cowork EXDEV rename failure on Windows 11 Pro 25H2 — MSIX sandbox treats AppData\Roaming and Temp as separate filesystems

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork has never successfully started on this system. The VM image download completes and checksum validates, but fs.rename() fails when attempting to move the file from Temp into the virtualized AppData\Roaming path. The downloaded file also lands with Application Protected EFS encryption tied to the MSIX package identity, which makes manual workarounds impossible — any unencrypted file placed in the bundle directory is rejected with "APPX file cannot be accessed because it is not encrypted as expected."This creates an irresolvable catch-22: Claude requires the file to be unencrypted to rename it, but the MSIX container requires files to be encrypted to access them.Additional issues found during investigation: Claude ships as SignatureKind: Developer rather than Store, causing WDAC policy conflicts on systems with Microsoft Endpoint Security Policy enforced. CoworkVMService also requires DISM component store repair to start on some Windows 11 25H2 configurations.

What Should Happen?

The VM image should download and be placed into the bundle directory successfully. The fix is to replace fs.rename() with fs.copyFile() + fs.unlink() as a fallback when EXDEV is encountered, as suggested in issues #25911 and #30584. Claude should also be distributed as a Store-signed MSIX rather than Developer-signed to avoid WDAC compatibility issues on systems with enforced code integrity policies.

Error Messages/Logs

EXDEV: cross-device link not permitted, rename 
'C:\Users\devin\AppData\Local\Temp\wvm-XXXXXX\rootfs.vhdx' -> 
'C:\Users\devin\AppData\Roaming\Claude\vm_bundles\claudevm.bundle\rootfs.vhdx'
cipher /c output:
E rootfs.vhdx
  Compatibility Level:
    Application Protected
CoworkVMService WIN32_EXIT_CODE: 1066
SERVICE_EXIT_CODE: 1

Steps to Reproduce

Install Claude Desktop 1.1.8359.0 on Windows 11 Pro 25H2 Build 26200.8037
Ensure Hyper-V, VirtualMachinePlatform, and HypervisorPlatform are enabled
Open Claude Desktop and navigate to Cowork
Observe "Failed to start Claude's workspace — VM service not running"
Check %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\logs\cowork_vm_node.log for EXDEV error
Run cipher /c on the downloaded rootfs.vhdx — observe Application Protected EFS encryption
All workarounds fail due to the encrypted/unencrypted catch-22 described above

Claude Model

Not sure / Multiple models

Is this a regression?

No, this never worked

Last Working Version

Claude Desktop: 1.1.8359.0

Claude Code Version

Claude Desktop: 1.1.8359.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Environment:

Claude Desktop: 1.1.8359.0
OS: Windows 11 Pro, Version 25H2, Build 26200.8037
SignatureKind: Developer (not Store-signed)
Hyper-V: Enabled, vmcompute and vmsp running
WDAC: Microsoft Windows Endpoint Security Policy enforced

Related Issues: #25911, #30584, #27897, #34605, #29941

_No response_