[BUG] Dispatch blocked by CSP: a-api.anthropic.com missing from connect-src in Electron webview

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Dispatch (Cowork) is unresponsive — messages sent from the Claude iOS app receive no response. The desktop session initializes but stays idle indefinitely. Regular Chat and Claude Code CLI both work fine on the same account.

Root cause: a-api.anthropic.com is not included in the connect-src CSP directive for the Electron webview. Every Dispatch session triggers a CSP violation that blocks the API call, leaving dispatch_agent_name as null.

Note: a-cdn.anthropic.com IS in the allowlist, but a-api.anthropic.com is NOT.

Error Messages/Logs

# ~/Library/Logs/Claude/claude.ai-web.log
2026-02-25 06:04:21 [error] Connecting to 'https://a-api.anthropic.com/v1/m' violates
the following Content Security Policy directive: "connect-src 'self'
https://api.segment.io https://*.segment.io https://*.segment.com
https://a-cdn.anthropic.com https://*.google.com https://*.facebook.com
https://*.facebook.net https://*.doubleclick.net". The action has been blocked.

# ~/Library/Logs/Claude/main.log
2026-03-28 10:15:38 [info] [transport:ccr] reportMetadata {"permission_mode":"default","dispatch_agent_name":null}

Suggested Fix

Add https://a-api.anthropic.com to the Electron webview CSP connect-src directive.

Steps to Reproduce

1. Open Claude Desktop → Cowork tab → Dispatch
2. Pair with Claude iOS app via QR code
3. Send any message from iPhone
4. Observe: no response on desktop or iPhone
5. Check ~/Library/Logs/Claude/claude.ai-web.log for CSP violation

Claude Model

Opus

Is this a regression?

No, this never worked

Claude Code Version

Latest (Claude Desktop)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

N/A (Claude Desktop)

Additional Information

Previously reported in #40083, which was incorrectly auto-closed as a duplicate of #39270 (an unrelated process crash issue) and subsequently auto-locked.