Egress allowlist ignores "All domains": every host outside a built-in list gets 403 on CONNECT (regression 2026-09-10 -> 2026-09-11)

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

With **Allow network egress = ON** and **Domain allowlist = "All domains"** (Settings -> Capabilities -> Code execution), the session egress proxy still rejects every host outside a small built-in allowlist with **403 on CONNECT**.

This is a **regression**. It broke between 2026-09-10 and 2026-09-11. 18 scheduled Cowork tasks that had been running daily for weeks all stopped producing output on 2026-09-11. The schedule still fires and every run is recorded as SUCCEEDED, but the first outbound call in each run is denied.

Measured from the cloud container: blocked are `json2news.radiobutler.com` (my own self-hosted API), `news.google.com`, `www.tagesschau.de`, `example.com`; `api.github.com` is allowed. The proxy status endpoint reports `"selective": false` and `"toolScoped": false`, i.e. plain allowlist mode.

The **local Cowork VM on the desktop (device_bash) is subject to the same policy**, so there is no fallback: HTTPS returns 403 there as well, and `sslin.df.eu` (IMAP, port 993) does not even resolve. A task that reads a mailbox over IMAP from the local VM therefore cannot work under any allowlist configuration, since the allowlist only covers HTTP(S) via CONNECT.

The target hosts are healthy: reached from the very same machine through the regular browser, the blocked self-hosted API answers `/health` with 200.

This looks like the same root cause as #34690, #30112 and #51400 — the session proxy JWT carries a fixed `allowed_hosts` list and does not reflect the "All domains" setting. What is new here is that it is now a hard regression for a setup that worked until 2026-09-10.

**Secondary issue:** a run in which every outbound call is denied is still recorded as `ROUTINE_RUN_STATUS_SUCCEEDED`, and nothing is surfaced in the task list. Scheduled tasks fail completely silently; the only way to notice is that the expected results never appear.

### What Should Happen?

With Domain allowlist = "All domains", outbound HTTPS from the cloud container **and** from the local Cowork VM should reach any host.

Additionally, a run in which every outbound call was denied by egress policy should not be recorded as SUCCEEDED — it should be marked failed, or the policy denial should be surfaced on the scheduled task.

### Error Messages/Logs

```shell
# cloud container (bash)
$ curl -sS -o /dev/null -w '%{http_code}\n' https://json2news.radiobutler.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://news.google.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://api.github.com/
200

# $HTTPS_PROXY/__agentproxy/status
"selective": false,
"toolScoped": false,
"recentRelayFailures": [
{"ts":"2026-09-11T07:25:14.412Z","kind":"connect_rejected",
"detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)",
"host":"json2news.radiobutler.com:443"},
{"ts":"2026-09-11T07:25:20.208Z","kind":"connect_rejected",
"detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)",
"host":"www.tagesschau.de:443"}
]

# local Cowork VM on the desktop (device_bash)
$ curl -sS https://json2news.radiobutler.com/
curl: (56) Received HTTP code 403 from proxy after CONNECT
$ python3 -c "import socket; socket.create_connection(('sslin.df.eu',993),15)"
[Errno -3] Temporary failure in name resolution

# same host reached from the regular browser on the same machine
GET https://json2news.radiobutler.com/health -> 200
{"status":"ok","utc":"2026-09-11T07:31:50Z","access":"open"}
```

### Steps to Reproduce

1. claude.ai -> Settings -> Capabilities -> Code execution -> **Allow network egress**: ON
2. **Domain allowlist**: "All domains" (the UI then states "Claude can access all domains on the internet")
3. Start a Cowork cloud session (or let a scheduled task fire)
4. In the session, run: `curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/`

Result: `curl: (56) CONNECT tunnel failed, response 403`. Expected: 200.

Same result inside the local Cowork VM via device_bash, and for any non-allowlisted host.

### Claude Model

Opus

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

Claude Desktop 1.52386.0 (worked until 2026-09-10)

### Claude Code Version

Claude Desktop 1.52386.0 (Cowork cloud session)

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

Other

### Additional Information

**Environment:** Claude Desktop on Windows, app version 1.52386.0 (Electron 44.2.0, Node 24.20.0), Cowork cloud session, model claude-opus-5. Personal organization, single user, I am the owner; the setting is verified in the UI and reads "Claude can access all domains on the internet".

**Impact:** 18 scheduled tasks (daily news research and upload pipelines for two radio stations, plus an IMAP mailbox monitor) produce nothing since 2026-09-11 while all being reported as successful. Blocked hosts include a self-hosted API (json2news.radiobutler.com), news sources (news.google.com, www.tagesschau.de, www.helgoland.de, sessionnet.owl-it.de and several Ukrainian outlets) and an IMAP server (sslin.df.eu:993).

**Related:** #34690 (All domains not reflected in session proxy JWT), #30112 (custom domains blocked with 403 blocked-by-allowlist), #51400 (additional-domain entries not enforced).

Start by reproducing the CONNECT 403 with the documented curl command in a Cowork cloud session, then inspect the __agentproxy/status response and the "All domains" setting under Settings → Capabilities → Code execution. Compare the behavior with the related issues #34690, #30112, and #51400. Done means non-allowlisted HTTPS hosts work when "All domains" is selected and fully denied scheduled runs are surfaced as failures rather than SUCCEEDED.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.