[BUG] Linux Cowork: cloud sessions can never link to computer — enclave key not implemented on Linux ("device not registered (no row-PK)"); reopening closed #79232 / #77348[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

On the Linux desktop beta, cloud Cowork sessions can never bind to the local computer, so attached folders are unusable. Previously reported in #79232 (root cause: Linux build of the native module returns hardwareKeyUnavailable: linux-not-yet-supported) and #77348. Both were auto-closed for inactivity and are locked, so I cannot comment. The bug is not fixed and is still reproducible.

Environment

• Distro / kernel: Ubuntu 26.04.1 LTS, 7.0.0-34-generic
• Desktop: KDE Plasma 6 (kwalletd6)
• Claude Desktop: 1.18286.0 (Installed; same Candidate)
• Arch: x86_64

What works

• Cowork VM boots: [VM:start] Startup complete, total time: 10347ms, guest ready, API REACHABLE
• Device bridge connects to wss://bridge.claudeusercontent.com/devices/.../bridge and publishes device_bash, device_list_dir, device_stage_files, device_commit_files
• [sessions-bridge] Session ... reconnected successfully
• [safeStorage] kwalletd pre-flight (kwalletd6): has-wallet; wallet confirmed open

What fails (every launch, every cloud session)

[device-registry] enclave key unavailable — refusing to resolve row-PK
[remote-file-tools] td-v2 attestation mint unavailable: DeviceRegistry: device not registered (no row-PK for this account)

UI: "Couldn't link this session to a computer, so attached folders can't be used. If this keeps happening, let us know."

Ruled out

• kvm group; /dev/kvm and /dev/vhost-vsock root:kvm 0660; vhost_vsock loaded and persisted
• qemu-system-x86, ovmf, virtiofsd installed
• KWallet open; --password-store=kwallet6
• User added to tss (/dev/tpmrm0 tss:tss 0660); rebooted
• Signed out of Claude Desktop, restarted, signed back in

Expected

Either implement the device key on Linux (TPM2 via /dev/tpmrm0 with a software fallback), or have the backend accept session binds without td-v2 attestation on platforms that have no key implementation. At minimum, show a clear "not yet supported on Linux" message instead of an intermittent-sounding link error.

Request

Please keep this open (or label it to exempt it from auto-close) until the fix ships.

What Should Happen?

When the Claude Desktop app is running on Linux (signed in, Cowork VM healthy), starting a cloud Cowork session with local folders attached should:

1. Register this computer with my account on first launch (create and persist the device key, resolve a row-PK). No enclave key unavailable or device not registered warnings in the logs.
2. Mint the td-v2 attestation and bind the cloud session to this computer, same as on macOS and Windows.
3. Expose the device bridge tools to the session (device_list_dir, device_stage_files, device_commit_files, device_bash) so Claude can read and write the attached folders.
4. Show no "Couldn't link this session to a computer" banner.

If device-key support for Linux isn't implemented yet, the app should instead:

• Say so explicitly ("Linking cloud sessions to this computer isn't supported on Linux yet") rather than showing a generic, retry-sounding error.
• Not let me attach local folders to a cloud session when they can't be used.
• Document the limitation on the Linux beta docs page (https://code.claude.com/docs/en/desktop-linux) under "What's not in the Linux beta yet".

Suggested fixes, in order of preference:

• Implement the device key on Linux: TPM2 via /dev/tpmrm0 where available, with a Secret Service/KWallet-backed or software fallback.
• As an interim fix, have the backend accept session binds without td-v2 attestation on platforms whose native module reports linux-not-yet-supported.

Error Messages/Logs

2026-09-27 11:20:11 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:20:12 [info] [safeStorage] kwalletd pre-flight (kwalletd6): has-wallet
2026-09-27 11:20:12 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:21:12 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:21:24 [info] [VM] API reachability: REACHABLE
2026-09-27 11:21:24 [info] [VM:start] Startup complete, total time: 12496ms
2026-09-27 11:21:44 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:22:21 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:22:21 [warn] [remote-file-tools] td-v2 attestation mint unavailable: DeviceRegistry: device not registered (no row-PK for this account)
2026-09-27 11:22:22 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:27:15 [info] [safeStorage] kwalletd pre-flight (kwalletd6): has-wallet
2026-09-27 11:27:48 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:27:49 [info] [remote-tools-device] connecting wss://bridge.claudeusercontent.com/devices/<redacted>/mjs-hx90/bridge
2026-09-27 11:27:49 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:27:50 [info] [sessions-bridge] Session cse_<redacted> reconnected successfully
2026-09-27 11:27:51 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:28:01 [info] [VM] API reachability: REACHABLE
2026-09-27 11:28:02 [info] [VM:start] Startup complete, total time: 11514ms
2026-09-27 11:28:19 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:28:24 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:29:02 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:29:19 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:29:20 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK
2026-09-27 11:29:20 [warn] [remote-file-tools] td-v2 attestation mint unavailable: DeviceRegistry: device not registered (no row-PK for this account)
2026-09-27 11:29:21 [warn] [device-registry] enclave key unavailable — refusing to resolve row-PK

Steps to Reproduce

Preconditions (all documented Cowork-on-Linux requirements met):

• Debian-based distro (Ubuntu 22.04+ / Debian 12+), x86_64, hardware virtualization enabled
• qemu-system-x86, ovmf, virtiofsd installed
• User in kvm group; /dev/kvm and /dev/vhost-vsock are root:kvm 0660
• vhost_vsock loaded and persisted via /etc/modules-load.d/vhost_vsock.conf
• Claude Desktop installed from the official apt repo; signed in with a claude.ai account

Steps

1. Launch Claude Desktop (claude-desktop).
2. Open an existing project, start a new session, select the Cowork tab, add local folders. Confirm the local VM starts: ~/.config/Claude/logs/cowork_vm_node.log shows [VM:start] Startup complete and API reachability: REACHABLE.
3. In the Cowork tab, connect one or more local folders (e.g. ~/Git/project) with Add folder.
4. Start a new Cowork task that runs in the cloud with those folders attached.
5. Ask Claude to list the contents of an attached folder.

Actual result

• The session shows the banner: "Couldn't link this session to a computer, so attached folders can't be used. If this keeps happening, let us know."
• The session sees the device name and folder names, but the device tools (device_list_dir, device_stage_files, device_commit_files, device_bash) are never available to it.
• Logs at the moment of the attempt:
• [device-registry] enclave key unavailable — refusing to resolve row-PK
• [remote-file-tools] td-v2 attestation mint unavailable: DeviceRegistry: device not registered (no row-PK for this account)

Reproducibility: 100%. Every launch, every new cloud session.

Persists after each of:

• Full app quit and relaunch
• OS reboot
• Launching with --password-store=kwallet6 (KWallet confirmed open)
• Adding user to tss group (/dev/tpmrm0 accessible) + reboot
• Signing out of Claude Desktop, restarting, signing back in

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

1.18286.0

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

_No response_