[BUG] Cowork Linux: SDK verification fails permanently ("SDK version X not verified") even after full VM bundle + SDK reset — checksum mismatch suspected

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork/Workspace fails to start on Linux with RPC error -1: "SDK version 2.1.209 not verified at /mnt/.virtiofs-root/home/kathi/.config/Claude/claude-code-vm/2.1.209/.verified". The error is 100% reproducible and occurs consistently ~1-2 seconds after guest ready / sdk_install started in every attempt.

I fully reset every host-side component individually, restarted between each test, and the error persisted identically every single time:

Deleted and re-downloaded the entire VM bundle (rootfs.img, ~10GB, fresh download from CDN)
Deleted and let the app regenerate ~/.config/Claude/claude-code-vm/2.1.209/
Reset sessiondata.img (persistent VM session disk)
Removed a custom virtiofsd symlink from /usr/local/bin (confirmed app uses its own bundled virtiofsd at /usr/lib/claude-desktop/resources/virtiofsd regardless)
Updated claude-desktop from 1.21459.0 → 1.21459.1 (no change)
Confirmed no stale reinstall-lock file exists
Confirmed ~/.config/Claude is on a healthy local ext4 filesystem (not network/exFAT storage)

Root cause suspicion: I compared the SHA-256 of the installed SDK binary against the hash stored in .verified, and they did not match:

.verified content (hash): c490ee9f257a758ba7af399813c2bbc2f0ab612e3d3290dd5bda7c1b206953a0
actual sha256sum of claude-code-vm/2.1.209/claude: ...b882f4b8b27772f897540df50f24000206f43a9426e8f7d19bd065959b69e9dd

This matches the pattern in #50493, where the app's internal HTTP download client silently truncates/corrupts the SDK binary download while still marking it as complete and writing a .verified marker that doesn't match the actual file content. Given that a full bundle re-download (~10GB) also didn't fix it, and the main.log shows no download/checksum log lines at all for the SDK install step (only [CCD] Wrote SDK version file: 2.1.209), it looks like the SDK binary itself may be served from / copied via an internal cache path that never gets a real integrity check against .verified before being reused.

Possibly related (different platform/symptom, same general area — SDK prepare/verify pipeline): #65649

What Should Happen?

Cowork should either install/verify the SDK binary successfully, or — if the download is genuinely corrupted — detect the checksum mismatch and automatically retry/re-download instead of repeatedly failing with the same stale, non-matching .verified marker.

Error Messages/Logs

~/.config/Claude/logs/cowork_vm_node.log (representative excerpt, repeats identically across all resets):

[info] [VM] Network status: CONNECTED
[info] [VM:steps] sdk_install started
[info] [postConnect] Installing SDK: subpath=home/kathi/.config/Claude/claude-code-vm, version=2.1.209
[info] [vm] installed 121 host CA certificates in guest
[error] [VM:start] Startup failed: Error: RPC error -1: "SDK version 2.1.209 not verified at /mnt/.virtiofs-root/home/kathi/.config/Claude/claude-code-vm/2.1.209/.verified"
[info] [VM:start] Skipping auto-reinstall (already attempted once)
[info] [VM] API reachability: REACHABLE

~/.config/Claude/logs/main.log (no download/checksum activity logged for the SDK step):

[info] [CCD] Wrote SDK version file: 2.1.209
[warn] [ScheduledTasks] startVM failed: Error: RPC error -1: "SDK version 2.1.209 not verified at /mnt/.virtiofs-root/home/kathi/.config/Claude/claude-code-vm/2.1.209/.verified"

Happy to share full debug logs via the in-app "Share Debug Logs" link if useful.

Steps to Reproduce

Steps to Reproduce

1. Install claude-desktop via the official apt repo on Linux Mint 22.3 (Ubuntu 24.04 "noble" base)
2. Open Claude Desktop, go to Code/Cowork tab, start a workspace
3. Observe VM boots successfully (network connects, guest ready), then fails at sdk_install with the RPC error above
4. Repeat after deleting any/all of: VM bundle, SDK folder, session disk — same failure every time

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Cowork VM SDK version: 2.1.209

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Environment

OS: Linux Mint 22.3 Cinnamon (Ubuntu 24.04 "noble" base)
Claude Desktop version: 1.21459.1 (installed via official apt repo, downloads.claude.ai/claude-desktop/apt/stable)
Cowork VM SDK version: 2.1.209
CPU: Intel Core i5-12400
qemu-system-x86: 8.2.2, socat and virtiofsd installed and functional (confirmed via file, VM boots and network connects fine)
~/.config/Claude is a symlink to a local ext4 partition (not network storage, not exFAT)