Egress allowlist ignores "All domains": every host outside a built-in list gets 403 on CONNECT (regression 2026-09-10 -> 2026-09-11)

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

With **Allow network egress = ON** and **Domain allowlist = "All domains"** (Settings -> Capabilities -> Code execution), the session egress proxy still rejects every host outside a small built-in allowlist with **403 on CONNECT**.

This is a **regression**. It broke between 2026-09-10 and 2026-09-11. 18 scheduled Cowork tasks that had been running daily for weeks all stopped producing output on 2026-09-11. The schedule still fires and every run is recorded as SUCCEEDED, but the first outbound call in each run is denied.

Measured from the cloud container: blocked are `json2news.radiobutler.com` (my own self-hosted API), `news.google.com`, `www.tagesschau.de`, `example.com`; `api.github.com` is allowed. The proxy status endpoint reports `"selective": false` and `"toolScoped": false`, i.e. plain allowlist mode.

The **local Cowork VM on the desktop (device_bash) is subject to the same policy**, so there is no fallback: HTTPS returns 403 there as well, and `sslin.df.eu` (IMAP, port 993) does not even resolve. A task that reads a mailbox over IMAP from the local VM therefore cannot work under any allowlist configuration, since the allowlist only covers HTTP(S) via CONNECT.

The target hosts are healthy: reached from the very same machine through the regular browser, the blocked self-hosted API answers `/health` with 200.

This looks like the same root cause as #34690, #30112 and #51400 — the session proxy JWT carries a fixed `allowed_hosts` list and does not reflect the "All domains" setting. What is new here is that it is now a hard regression for a setup that worked until 2026-09-10.

**Secondary issue:** a run in which every outbound call is denied is still recorded as `ROUTINE_RUN_STATUS_SUCCEEDED`, and nothing is surfaced in the task list. Scheduled tasks fail completely silently; the only way to notice is that the expected results never appear.

### What Should Happen?

With Domain allowlist = "All domains", outbound HTTPS from the cloud container **and** from the local Cowork VM should reach any host.

Additionally, a run in which every outbound call was denied by egress policy should not be recorded as SUCCEEDED — it should be marked failed, or the policy denial should be surfaced on the scheduled task.

### Error Messages/Logs

```shell
# cloud container (bash)
$ curl -sS -o /dev/null -w '%{http_code}\n' https://json2news.radiobutler.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://news.google.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://api.github.com/
200

# $HTTPS_PROXY/__agentproxy/status
"selective": false,
"toolScoped": false,
"recentRelayFailures": [
{"ts":"2026-09-11T07:25:14.412Z","kind":"connect_rejected",
"detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)",
"host":"json2news.radiobutler.com:443"},
{"ts":"2026-09-11T07:25:20.208Z","kind":"connect_rejected",
"detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)",
"host":"www.tagesschau.de:443"}
]

# local Cowork VM on the desktop (device_bash)
$ curl -sS https://json2news.radiobutler.com/
curl: (56) Received HTTP code 403 from proxy after CONNECT
$ python3 -c "import socket; socket.create_connection(('sslin.df.eu',993),15)"
[Errno -3] Temporary failure in name resolution

# same host reached from the regular browser on the same machine
GET https://json2news.radiobutler.com/health -> 200
{"status":"ok","utc":"2026-09-11T07:31:50Z","access":"open"}
```

### Steps to Reproduce

1. claude.ai -> Settings -> Capabilities -> Code execution -> **Allow network egress**: ON
2. **Domain allowlist**: "All domains" (the UI then states "Claude can access all domains on the internet")
3. Start a Cowork cloud session (or let a scheduled task fire)
4. In the session, run: `curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/`

Result: `curl: (56) CONNECT tunnel failed, response 403`. Expected: 200.

Same result inside the local Cowork VM via device_bash, and for any non-allowlisted host.

### Claude Model

Opus

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

Claude Desktop 1.52386.0 (worked until 2026-09-10)

### Claude Code Version

Claude Desktop 1.52386.0 (Cowork cloud session)

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

Other

### Additional Information

**Environment:** Claude Desktop on Windows, app version 1.52386.0 (Electron 44.2.0, Node 24.20.0), Cowork cloud session, model claude-opus-5. Personal organization, single user, I am the owner; the setting is verified in the UI and reads "Claude can access all domains on the internet".

**Impact:** 18 scheduled tasks (daily news research and upload pipelines for two radio stations, plus an IMAP mailbox monitor) produce nothing since 2026-09-11 while all being reported as successful. Blocked hosts include a self-hosted API (json2news.radiobutler.com), news sources (news.google.com, www.tagesschau.de, www.helgoland.de, sessionnet.owl-it.de and several Ukrainian outlets) and an IMAP server (sslin.df.eu:993).

**Related:** #34690 (All domains not reflected in session proxy JWT), #30112 (custom domains blocked with 403 blocked-by-allowlist), #51400 (additional-domain entries not enforced).

Start by reproducing the CONNECT 403 with the documented curl command in a Cowork cloud session, then inspect the __agentproxy/status response and the "All domains" setting under Settings → Capabilities → Code execution. Compare the behavior with the related issues #34690, #30112, and #51400. Done means non-allowlisted HTTPS hosts work when "All domains" is selected and fully denied scheduled runs are surfaced as failures rather than SUCCEEDED.

Escrita pelo modelo de indexação a partir do texto da issue.