[BUG] MCP Network Allowlist Still Blocking External APIs - v1.1.7714

Problem

Co-Work sandbox continues to block external API connections despite declaring them in .cowork manifest. MCP servers fail with connection errors.

Environment

• Claude Code Version: 1.1.7714 (3bd6f6)
• Timestamp: 2026-03-19T14:50:53.000Z
• Platform: macOS
• Related Issue: #28067

Details

The VM's network allowlist is not respecting manifest declarations for external APIs. Attempting to connect to whitelisted APIs (e.g., api.openai.com) results in:

Connection blocked by network allowlist

This appears to be the same root cause as #28067 - the host-side session manager is not extracting and merging domains from plugin-declared MCP servers into the VM's allowedDomains list.

Expected Behavior

• Plugin declares MCP server domain in manifest
• Session manager extracts domain from manifest
• Domain is added to VM's network allowlist before spawning
• Connection succeeds

Actual Behavior

• Domain remains blocked regardless of manifest declaration
• Static allowlist (~23 domains) never extends

Impact

• Co-Work plugins cannot integrate with external APIs
• Blocks production use of AI automation workflows
• No workaround available without manual VM intervention

Request

1. Clarification: Is #28067 the blocker for this, or is this a separate issue?
2. ETA on network allowlist fix?
3. Interim solution available?