[BUG] MSIX + Smart App Control: Windows-MCP blocked (os error 4551), and Directory extension install silently fails ("installDxtFromDirectory: reply was never sent") on 1.12603.1

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Follow-up to #29302 (closed as not planned), with new findings on app 1.12603.1, including a partial workaround and a second bug that makes reinstallation impossible.

Environment

• Claude Desktop MSIX/Store version, package Claude_pzs8sxrjxfjjc, app 1.12603.1
• Windows 11 with Smart App Control (SAC) enforced (cannot be disabled without OS reinstall)
• Windows-MCP extension 0.7.1 (server runtime 3.2.0), Python 3.13, uv at %USERPROFILE%\.local\bin\uv.exe

Issue 1 — SAC blocks the unsigned binary (same root cause as #29302)
The manifest starts the server via uv --directory ${__dirname} run windows-mcp. uv spawns an unsigned windows-mcp.exe from the venv, which SAC rejects:

error: Failed to spawn: `windows-mcp`
  Caused by: An Application Control policy has blocked this file. (os error 4551)

Working workaround (new vs #29302): launching via the signed venv python IS allowed by SAC. Editing manifest.json to:

"command": "${__dirname}/.venv/Scripts/python.exe",
"args": ["-m", "windows_mcp"]

made the server start and return its full tool list (verified June 8). So code-signing the spawned exe OR defaulting to the python interpreter route would fix this for SAC machines.

Issue 2 — manifest edit makes the extension invisible on 1.12603.1
Every app/extension update reverts manifest.json to the uv route. After re-applying the edit on 1.12603.1, the extension disappears from Connectors and the Directory shows "Install" again, even though the extension folder and its entry in extensions-installations.json are intact and the startup can_install check still lists it. Suspected: hash verification against the install-time hash fails after the manifest edit and the extension is silently treated as not installed.

Issue 3 — Directory install silently fails, so reinstalling is impossible
Clicking Install in the Directory does nothing visible. Log shows:

[error] Uncaught (in promise) Error: Error invoking remote method
'$eipc...claude.settings_$_Extensions_$_installDxtFromDirectory': reply was never sent

One attempt did download and log Installing unsigned extension from %TEMP%\dxt-download-*.mcpb but never created the extension folder. Possibly related: the installer probes python3, which hits the Microsoft Store stub ("Python was not found..."); disabling the App execution aliases did not help. After fully removing both the extension folder and its extensions-installations.json entry (clean slate), clicking Install produces no log activity at all.

Issue 4 (minor) — CoworkVMService stopped after update
After the same update, "Failed to start Claude's workspace — VM service not running": service CoworkVMService (StartType Automatic) was Stopped; manual Start-Service CoworkVMService fixed it.

Net effect: on a SAC-enforced machine, Windows-MCP is currently unusable and cannot be reinstalled. Full logs (main.log, mcp-server-Windows-MCP.log) available on request.

What Should Happen?

On a SAC-enforced Windows 11 machine (MSIX build): one-click install of Windows-MCP from the Directory should succeed, the server should start (signed binary, or launched via the signed python interpreter), and a failed install should surface a visible error instead of failing silently.

Error Messages/Logs

Steps to Reproduce

1. Windows 11 with Smart App Control enforced; Claude Desktop MSIX/Store build 1.12603.1
2. Install "Windows-MCP" from Directory > Connectors and enable it
3. Server fails to start; mcp-server-Windows-MCP.log shows Failed to spawn: windows-mcp ... os error 4551
4. Workaround: edit manifest.json to "command": "${__dirname}/.venv/Scripts/python.exe", "args": ["-m","windows_mcp"] -> server starts fine
5. Wait for an app/extension update: manifest reverts to uv route, error 4551 returns; on 1.12603.1 the extension also disappears from Connectors and Directory shows "Install" again
6. Click Install in Directory -> nothing happens; main.log shows installDxtFromDirectory: reply was never sent
7. Remove extension folder + its entry in extensions-installations.json, restart, click Install -> still no install, no log activity

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

1.11187.4.0 (worked with the manifest workaround; one-click install last worked before ~June 5 update)

Claude Code Version

Claude Desktop 1.12603.1 (MSIX), bundled CCD/SDK 2.1.170

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_