[BUG] Cowork sandbox ignores network allowlist entirely — regression, worked 2026-07-29 through ~2026-09-04

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

**Product:** Claude Cowork (desktop app, macOS), session linked to local computer
**Date observed:** 2026-09-11
**Plan:** [Adam: Pro / Max / Team — fill in]
**Session IDs:** `cse_01MZV7cN7ZEtwfcXNSHajzS1` (diagnosis session), plus a fresh session started the same day after the setting change (see step 6)
**Container environment type:** `CLAUDE_CODE_REMOTE_ENVIRONMENT_TYPE=cloud_default`; `CLAUDE_CODE_USE_CCR_V2=true`; runner `release-ba76006550-ext`
**Related:** #38984, #63182, #30112, #59851, #23818, #37970 — same symptom. Difference here: this configuration WORKED for six weeks and stopped without any change on my side.

## Summary

Settings → Capabilities → Domain allowlist is not applied to the sandbox. With mode "Package managers only" plus four entries under "Additional allowed domains", all four entries are refused. With mode changed to "All domains" and a fresh session started, the same hosts are still refused. Package-manager defaults (github.com) pass. The identical allowlist worked instantly from 2026-07-29 until my last successful session around 2026-09-04.

Both shells are affected: the cloud container shell and the local VM shell (`device_bash`) on the linked Mac. After quitting and relaunching the desktop app, the local VM shell lost outbound HTTPS entirely, including to package-manager hosts.

## Configuration (screenshot available)

Settings → Capabilities → Domain allowlist:
- Mode: "Package managers only"
- Additional allowed domains: `app1.aspireendeavors.com`, `app1.ingestigate.com`, `sso.ingestigate.com`, `youtube.com`

Entries are bare hostnames, exactly as the placeholder text shows.

## Repro

1. Add the four hostnames above under Additional allowed domains (mode: Package managers only).
2. Start a Cowork session linked to the Mac. In the cloud shell, run:

```
for h in sso.ingestigate.com app1.aspireendeavors.com youtube.com github.com; do
printf "%-28s " "$h"; curl -sS -o /dev/null -w "HTTP %{http_code}\n" --max-time 15 "https://$h/" 2>&1 | tail -1
done
```

3. Result (cloud shell):

```
sso.ingestigate.com HTTP 000
app1.aspireendeavors.com HTTP 000
youtube.com HTTP 000
github.com HTTP 400 <- reaches GitHub; the tunnel works
```

curl error on the 000 rows: `curl: (56) CONNECT tunnel failed, response 403`.
The agent proxy's status endpoint (`$HTTPS_PROXY/__agentproxy/status`) records each as:

```
{"kind":"connect_rejected","detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)","host":"sso.ingestigate.com:443"}
```

Same result from the local VM shell: `curl: (56) Received HTTP code 403 from proxy after CONNECT` via `localhost:3128`.

4. Control from the Mac's own Terminal (outside the sandbox), same minute: `sso.ingestigate.com` discovery doc → 200; `app1.aspireendeavors.com/api/users` → 401 (reachable, auth required); a Keycloak device-code mint → 200. All hosts healthy.
5. Change Domain allowlist mode to **"All domains"**. Quit and relaunch the desktop app. Confirm the setting persisted.
6. Start a NEW Cowork session and run the same loop. Result:

```
sso.ingestigate.com HTTP 000
app1.aspireendeavors.com HTTP 000
youtube.com HTTP 000
github.com HTTP 400
pypi.org HTTP 403 <- reaches PyPI (403 is PyPI's own answer to "/")
```

The local VM shell in that new session returned `000` for every host including github.com and pypi.org.

## Expected

- With additional domains listed, CONNECT to those hosts succeeds.
- With "All domains", CONNECT to any host succeeds.
- The local VM shell keeps package-manager access after the desktop app restarts.

## Actual

- The allowlist mode and the additional-domains list have no effect on the cloud shell. Only the package-manager baseline is honored.
- The local VM shell's proxy stops answering after an app relaunch.

## History

- 2026-07-29: the two `ingestigate`/`aspireendeavors` hosts were initially blocked, I added them to Additional allowed domains, and they worked immediately in the same session.
- 2026-07-29 → ~2026-09-04: dozens of daily sessions used these hosts successfully via the same allowlist (a documented device-flow OAuth grant against `sso.ingestigate.com` and API calls against `app1.aspireendeavors.com`).
- 2026-09-11: every session refuses them. No change to the allowlist, plan, or hosts on my side.

## Impact

Hard work stoppage. The sandbox can no longer reach my own application's API, which every scheduled and interactive workflow on this account depends on. The browser tools still reach the hosts, but they are not a substitute for shell/API access.

## What I've ruled out

- Host/DNS/TLS problems: verified reachable from the Mac's Terminal.
- Entry format: bare hostnames; a third unrelated entry (`youtube.com`) fails identically.
- Stale session: reproduced in a fresh session after the setting change and an app restart.
- Base proxy failure: package-manager hosts tunnel fine from the cloud shell.

### What Should Happen?

- With additional domains listed, CONNECT to those hosts succeeds.
- With "All domains", CONNECT to any host succeeds.
- The local VM shell keeps package-manager access after the desktop app restarts.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

## Configuration (screenshot available)

Settings → Capabilities → Domain allowlist:
- Mode: "Package managers only"
- Additional allowed domains: `app1.aspireendeavors.com`, `app1.ingestigate.com`, `sso.ingestigate.com`, `youtube.com`

Entries are bare hostnames, exactly as the placeholder text shows.

## Repro

1. Add the four hostnames above under Additional allowed domains (mode: Package managers only).
2. Start a Cowork session linked to the Mac. In the cloud shell, run:

```
for h in sso.ingestigate.com app1.aspireendeavors.com youtube.com github.com; do
printf "%-28s " "$h"; curl -sS -o /dev/null -w "HTTP %{http_code}\n" --max-time 15 "https://$h/" 2>&1 | tail -1
done
```

3. Result (cloud shell):

```
sso.ingestigate.com HTTP 000
app1.aspireendeavors.com HTTP 000
youtube.com HTTP 000
github.com HTTP 400 <- reaches GitHub; the tunnel works
```

curl error on the 000 rows: `curl: (56) CONNECT tunnel failed, response 403`.
The agent proxy's status endpoint (`$HTTPS_PROXY/__agentproxy/status`) records each as:

```
{"kind":"connect_rejected","detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)","host":"sso.ingestigate.com:443"}
```

Same result from the local VM shell: `curl: (56) Received HTTP code 403 from proxy after CONNECT` via `localhost:3128`.

4. Control from the Mac's own Terminal (outside the sandbox), same minute: `sso.ingestigate.com` discovery doc → 200; `app1.aspireendeavors.com/api/users` → 401 (reachable, auth required); a Keycloak device-code mint → 200. All hosts healthy.
5. Change Domain allowlist mode to **"All domains"**. Quit and relaunch the desktop app. Confirm the setting persisted.
6. Start a NEW Cowork session and run the same loop. Result:

```
sso.ingestigate.com HTTP 000
app1.aspireendeavors.com HTTP 000
youtube.com HTTP 000
github.com HTTP 400
pypi.org HTTP 403 <- reaches PyPI (403 is PyPI's own answer to "/")
```

The local VM shell in that new session returned `000` for every host including github.com and pypi.org.

### Claude Model

Other

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

Claude 1.52386.0 (1003ca) 2026-09-10T05:55:17.000Z

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

iTerm2

### Additional Information

_No response_

No source files or tests are named. Start by reproducing the cloud-shell and local-VM results with the provided curl loop, then inspect the agent proxy status endpoint and the persisted Domain allowlist setting across an app restart. Done means additional domains and All domains permit CONNECT as expected, while the local VM retains package-manager access.

Rédigé par le modèle d'indexation à partir du texte de l'issue.