feat(claude_desktop): add cowork virtualization stack (qemu, ovmf, docker, virtiofsd)

Adds qemu-system-x86, ovmf, and docker.io (Bookworm main) plus virtiofsd
for sharing the workspace into the sandbox microVM. virtiofsd has no
Bookworm/backports package and its trixie .deb would GLIBC-mismatch the
runtime, so it's built from the pinned crates.io release in a dedicated
builder stage, mirroring the existing rtk/tokensave pattern.

Also updates the repo versioning convention in CLAUDE.md: local patch
counters should use a dot (X.Y.Z.N) instead of a hyphen (X.Y.Z-N), since
the hyphen form parses as a semver pre-release and Supervisor won't offer
the update.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -92,11 +92,13 @@ The `env_vars` schema key enables the env-var passthrough mechanism. At runtime
 Add-on versions in `config.yaml` closely follow the upstream release tag and do not conform to a single fixed format. Common patterns include:
 
 - `X.Y.Z` – plain upstream semver (e.g. `0.137.0`)
-- `X.Y.Z-N` – upstream version with a local patch counter (e.g. `0.6.26-2`)
+- `X.Y.Z.N` – upstream version with a local patch counter (e.g. `0.6.26.2`)
 - LSIO-style tags (e.g. `1.43.1.10611-1e34174b1-ls301`)
 - Date-based versions (e.g. `2026.02.28`)
 - Nightly builds (e.g. `nightly-20260321-397`)
 
+For the local patch counter, use a dot (`X.Y.Z.N`), not a hyphen. `X.Y.Z-N` parses as a semver pre-release tag, which Home Assistant Supervisor treats as *older* than plain `X.Y.Z` — it will not offer the update. New and updated add-ons should use `.N`; existing `-N` versions should be migrated to `.N` opportunistically (e.g. when that add-on is next touched), not as a standalone repo-wide sweep.
+
 When an upstream version is bumped, update `version` in `config.yaml`. If the add-on's `Dockerfile` contains an `ARG BUILD_UPSTREAM` line, update that value too — it is the canonical place that records the upstream version at build time (it is **not** stored in `build.json`/`build.yaml`). Some add-ons do not use `BUILD_UPSTREAM` at all. The `updater.json` file tracks which upstream source/repo to monitor and records the last seen version.
 
 ## updater.json Format

claude_desktop/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 1.33 (22-07-2026)
+- Add cowork virtualization support: `qemu-system-x86`, `ovmf`, and `docker.io` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start.
+ 
 ## ubunturesolute-version-8208e985 (2026-07-21)
 - Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases)
  

claude_desktop/Dockerfile

@@ -12,6 +12,7 @@ ARG BUILD_VERSION
 ARG RTK_VERSION="v0.43.0"
 ARG RTK_COMMIT="5a7880d404db8364d602f2ecdc41dd790f64013f"
 ARG TOKENSAVE_VERSION="7.4.0"
+ARG VIRTIOFSD_VERSION="1.14.0"
 
 # The upstream aarch64 release is cross-built on ubuntu-latest and requires
 # GLIBC 2.39. Build the pinned source on Bookworm instead so it is compatible
@@ -33,6 +34,24 @@ ARG TOKENSAVE_VERSION
 RUN cargo install tokensave --version "${TOKENSAVE_VERSION}" --locked --root /out && \
     /out/bin/tokensave --version
 
+# virtiofsd is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports;
+# installing the trixie .deb on the Bookworm runtime would pull a binary linked against a
+# newer GLIBC. Build the pinned crates.io release from source on Bookworm so the daemon's
+# ABI matches the add-on runtime (same rationale as the rtk and tokensave builders above).
+# Cowork shares the workspace into its qemu microVM through virtiofsd.
+FROM rust:1.91-bookworm AS virtiofsd-builder
+ARG VIRTIOFSD_VERSION
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libseccomp-dev \
+        libcap-ng-dev \
+        pkg-config \
+        clang \
+        libclang-dev && \
+    cargo install virtiofsd --version "${VIRTIOFSD_VERSION}" --locked --root /out && \
+    /out/bin/virtiofsd --version && \
+    rm -rf /var/lib/apt/lists/*
+
 FROM ${BUILD_FROM}
 ARG BUILD_ARCH
 
@@ -85,6 +104,9 @@ RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; f
 # Install Claude Desktop, Claude Code, Python tooling, and lightweight local validators.
 # gnome-keyring provides the Secret Service backend Electron safeStorage needs to persist
 # sign-in and dispatch grants.
+# The cowork virtualization stack (qemu-system-x86 + ovmf firmware + docker.io) lets Claude
+# Code launch its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the
+# source-built virtiofsd daemon links against at runtime.
 RUN install -d -m 0755 /etc/apt/keyrings && \
     curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc https://downloads.claude.ai/claude-desktop/key.asc && \
     curl -fsSLo /etc/apt/keyrings/claude-code.asc https://downloads.claude.ai/keys/claude-code.asc && \
@@ -102,7 +124,12 @@ RUN install -d -m 0755 /etc/apt/keyrings && \
         ripgrep \
         jq \
         shellcheck \
-        yamllint && \
+        yamllint \
+        qemu-system-x86 \
+        ovmf \
+        docker.io \
+        libseccomp2 \
+        libcap-ng0 && \
     test -x /usr/bin/claude && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
@@ -134,7 +161,10 @@ RUN set -eux; \
 # image. This makes an ABI mismatch fail the image build instead of surfacing at runtime.
 COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk
 COPY --from=tokensave-builder /out/bin/tokensave /usr/local/bin/tokensave
-RUN /usr/local/bin/rtk --version && /usr/local/bin/tokensave --version
+COPY --from=virtiofsd-builder /out/bin/virtiofsd /usr/local/bin/virtiofsd
+RUN /usr/local/bin/rtk --version && \
+    /usr/local/bin/tokensave --version && \
+    /usr/local/bin/virtiofsd --version
 
 # Install only the Headroom proxy, code-compression, and MCP features used by this add-on,
 # plus mcp-proxy (stdio->HTTP bridge for the Home Assistant MCP server) and uv (fast

claude_desktop/config.yaml

@@ -110,5 +110,5 @@ slug: claude_desktop
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "ubunturesolute-version-8208e985"
+version: "1.33"
 video: true