Cloud routine: account 'Allow network egress' allowlist domains not reaching sandbox proxy

Summary

A cloud routine's "Allow network egress" additional-domains setting (configured at claude.ai/settings/capabilities) does not reach the routine's cloud sandbox. The domain remains blocked by the sandbox's egress proxy even a week after being added, across three separate sandbox sessions (two scheduled fires, one manual trigger run).

Environment

• Trigger ID: trig_01DY6KyDJVs4BjEbar6jfmbv (routine name: obsidian-sermon-scan)
• Environment ID: env_01AW61N7pcXnWW8ir9JXuNnA
• Repo: dub10us/mental-notes (private)
• Domains added to account-level "Allow network egress" additional-domains list: www.youtube.com, i.ytimg.com, *.googlevideo.com (added 2026-08-10 at claude.ai/settings/capabilities)

Steps to reproduce

1. Create a Claude Code cloud routine (via /schedule or the RemoteTrigger API) whose prompt fetches a URL on a domain not in the environment's default egress allowlist.
2. Add that domain to the account's "Allow network egress" additional-domains list at claude.ai/settings/capabilities.
3. Fire the routine (scheduled or manual RemoteTrigger run) — either via a fresh sandbox session.
4. Attempt to fetch the domain via WebFetch or a direct curl inside the sandbox.

Expected behavior

The added domain should be reachable from the routine's sandbox — either immediately, or after some reasonable propagation delay.

Actual behavior

Every attempt is rejected, both via WebFetch and direct curl:

• WebFetch → {"error_type":"EGRESS_BLOCKED","domain":"www.youtube.com","message":"Access to www.youtube.com is blocked by the network egress proxy."}
• curl → curl: (56) CONNECT tunnel failed, response 403

Confirmed via the in-sandbox proxy status endpoint ($HTTPS_PROXY/__agentproxy/status) that www.youtube.com does not appear in the proxy's allowed domains.

This has now failed identically three times, a week apart from the allowlist change, ruling out simple propagation delay:

| Date | Trigger | Session |
|---|---|---|
| 2026-08-09 | scheduled fire (first live run after allowlist did not yet exist) | cse_0193xVGwTHxniaRAANYcPF25 |
| 2026-08-16 | scheduled fire (first test against the 2026-08-10 allowlist change) | cse_016A7aR9WKaSrj1igHVGyccf |
| 2026-08-17 | manual RemoteTrigger run (explicit retest) | cse_011XEoyN8Up1SKBgaBKYQocB |

Notes

• RemoteTrigger get/update on the trigger only exposes job_config (prompt, session_context.allowed_tools, MCP connections) and scheduling — there is no field for the sandbox's network/egress policy, so this can't be worked around or diagnosed further via the trigger API itself.
• Workaround in use: running the same fetch from a local session (normal network access) instead of the cloud sandbox.