Allow .local development domains in the local test-host allowlist

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

When I develop a web app locally, I need to use a .local domain (for example myapp.local, served on my own machine with a self-signed certificate), because it is not blocked by Google services when testing integrations that break on other local domains.

Claude Code lets me test my own application with test credentials and test accounts only on a fixed list of local hosts: localhost, 127.0.0.1, [::1], *.localhost and *.test. A .local domain is not on that list, so Claude refuses to enter test passwords or create a test user on my local dev site, even when I explicitly authorize it in chat and the site runs only on my own computer. I have to do those steps by hand, which defeats the purpose of end-to-end testing with the agent.

Proposed Solution

Add .local (mDNS-style local development domains such as myapp.local) to the list of local development hosts where Claude may enter test credentials and create test accounts in the user's own application, under the same conditions as today (the user asked in chat, values are test values, nothing is sent to another host).

Alternative: make the list user-configurable (for example a setting with extra local dev hostnames/suffixes that the user explicitly trusts), so people who use *.local, *.dev.local or custom Laragon/Valet/DDEV domains are not forced to rename their environment.

Alternative Solutions

_No response_

Priority

Medium - Would be very helpful

Feature Category

Configuration and settings

Use Case Example

1. I run my e-shop locally on https://myapp.local (Laragon, self-signed certificate).
2. I ask Claude to test a change to the admin user management end to end in the browser.
3. For that it needs to create a temporary test admin user and sign in as that user and as my own account (browser-saved credentials).
4. Because .local is not on the allowed local host list, Claude refuses to enter the test password or create the test account, so I have to do every sign-in and account creation manually and the agent can only verify what happens afterwards.
5. With .local allowed (or a user-configurable host list), the agent could run the whole scenario itself against my local dev instance, using throwaway test credentials only.

Additional Context

Related issues: #64745 (same request for .test, .local, localhost; closed as not planned by the stale bot and locked, so I cannot comment there) and #78160 (open, broader opt-in for credential entry in dev environments). This request is the narrow, low-risk part: .local is a reserved mDNS/local TLD (RFC 6762), like .test (RFC 6761), and sites on it run on the user's own machine.

Environment: Claude desktop app (Code tab) on Windows 11, Claude in Chrome and the built-in browser.