[BUG] Cowork network egress allowlist not applying to subdomains

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Added the following domains to Settings → Capabilities → Network Access allowlist: greenhouse.io, ashbyhq.com, lever.co, himalayas.app, job-boards.greenhouse.io, jobs.ashbyhq.com, jobs.lever.co. After multiple restarts, all domains continue to return EGRESS_BLOCKED errors via the Cowork WebFetch tool. The allowlist appears to have no effect on the VM proxy.
Related GitHub issues: #30112, #23818, #19087

What Should Happen?

Claude Co-work should be able to browse these domains

Error Messages/Logs

Attempted to fetch job listings from four sites; all blocked by network proxy

Steps to Reproduce

Open Claude desktop app (Cowork mode)
Go to Settings → Capabilities → Network Access
Add the following domains to the allowlist: greenhouse.io, job-boards.greenhouse.io, boards.greenhouse.io, ashbyhq.com, jobs.ashbyhq.com, lever.co, jobs.lever.co, himalayas.app
Restart the Claude desktop app
In a Cowork session, attempt to fetch any of the above domains using the WebFetch tool
Observe: all domains return {"error_type":"EGRESS_BLOCKED","message":"Access to [domain] is blocked by the network egress proxy."}

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Version 1.1.6041 (62e193)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_