[BUG] Cloud environment allowlist missing cache.ruby-lang.org — rbenv install fails with 403

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

rbenv install fails in the cloud environment setup script because cache.ruby-lang.org is not on the default domain allowlist.

The cloud image ships with Ruby 3.1.6, 3.2.6, and 3.3.6. Projects that pin a different patch version (e.g. 3.3.7 via .ruby-version + Gemfile) cannot install the required version because ruby-build downloads source tarballs from cache.ruby-lang.org, which the security proxy blocks.

The default allowed domains include ruby-lang.org and www.ruby-lang.org under "Package Managers - Ruby", but not the cache.ruby-lang.org subdomain — the official CDN that serves all Ruby source tarballs.

This is the same class of issue as #13372 (Maven Central blocked despite JVM being listed as supported) and #19512 (GitHub release artifacts blocked).

What Should Happen?

rbenv install 3.3.7 should succeed in a setup script when using "Limited" (default) network access. cache.ruby-lang.org should be included in the default allowlist.

Steps to Reproduce

1. Create a cloud environment with default "Limited" network access
2. Add this setup script:

#!/bin/bash
apt-get update -y || true
apt-get install -y libicu-dev
rbenv install 3.3.7
rbenv global 3.3.7

1. Start a new session

Error Output

==> Downloading ruby-3.3.7.tar.gz...
-> curl -q -fL -o ruby-3.3.7.tar.gz https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.7.tar.gz
curl: (22) The requested URL returned error: 403
error: failed to download ruby-3.3.7.tar.gz

BUILD FAILED (Ubuntu 24.04 on x86_64 using ruby-build 20260121-6-gd395d1ae)

The proxy also logs x-deny-reason: host_not_allowed for this domain.

Suggested Fix

Add cache.ruby-lang.org to the default allowed domains under "Package Managers - Ruby". Alternatively, use a wildcard *.ruby-lang.org to match the pattern used for other ecosystems (e.g. *.googleapis.com, *.sentry.io).

Workaround

Override .ruby-version in the setup script to use the pre-installed 3.3.6 and run bundle update --ruby to update Gemfile.lock. This works but forces a version mismatch between local and cloud environments.

Environment

• Platform: Claude Code on the web (cloud environment)
• Cloud image: Ubuntu 24.04, default universal image
• Pre-installed Ruby: 3.1.6, 3.2.6, 3.3.6 via rbenv
• Network access: Limited (default)