[BUG] Cowork/cloud sessions: artifact reads stay blocked after adding *.frame.claudeusercontent.com to the environment allowlist

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Adding *.frame.claudeusercontent.com to a personal cloud environment's Allowed domains does not enable artifact reads. Sessions started after the change still fail with the environment-allowlist error, while package-manager egress in the same environment works normally. Publishing artifacts works; only reads fail.

The docs explicitly instruct adding this domain for this purpose: "If sessions in the environment work with artifacts, include *.frame.claudeusercontent.com in your list. Claude Code fetches artifact content from that host." (https://code.claude.com/docs/en/cloud-environments)

Environment configuration

Personal environment named Default, edited from the environment selector at claude.ai/code:

• Network access: Custom
• Allowed domains:

``
*.frame.claudeusercontent.com
*.frame.staging.claudeusercontent.com
``
Both entries were inserted by the dialog's own Add Artifact content domains button, which is greyed out afterwards, confirming the setting registered.

• "Also include default list of common package managers": checked
• Environment variables: empty
• Saved. The dialog states "Changes to your environment will apply to new sessions."

Surface: Cowork in the Claude desktop app, sessions running in an Anthropic-hosted cloud environment. The desktop app was fully quit and reopened, and new sessions were started, before retesting.

Additional observations

1. Package-manager egress works in the same session: TLS handshakes to pypi.org and registry.npmjs.org complete, so the environment's network is functional and the default list is being applied.

1. A TLS handshake to the artifact host also completes from inside a session, using a plain socket to <artifact-id>.frame.claudeusercontent.com:443. Whether that terminates at the real host or at the egress proxy, the artifact tool refuses before attempting the fetch, which suggests the refusal comes from a policy snapshot rather than an observed connection failure. This matches #19087, where the container's JWT allowed_hosts claim was found to contain only the default package-manager domains.

1. The error names the per-artifact subdomain <artifact-id>.frame.claudeusercontent.com, while the allowlist entry is the wildcard *.frame.claudeusercontent.com.

1. The remediation path in the error message does not exist. "environment settings → Code → Network access → Custom → Allowed domains" reads as a settings menu, but personal environments have no settings page; the only entry point is the cloud chip above the message box at claude.ai/code, as the docs state. Pointing users at a nonexistent path costs a lot of time before they find the real control.

1. Cowork's new-session screen has no environment selector. Starting a new Cowork session in the desktop app shows the composer with Chat/Cowork, model and Project/Manual, and no cloud chip, so there is no way to see which environment a Cowork session is running in or to choose one. When the allowlist appears not to work, a user cannot distinguish "the setting is broken" from "this session used a different environment," which makes the problem undiagnosable from the UI.

Impact

Sessions can publish an artifact but never read one back. That breaks the intended update flow, where a session re-reads the live artifact and merges before republishing. With reads unavailable, a conflicting publish can only be resolved by forcing, which discards another session's work. That happened here and cost several hours of concurrent work from a second chat, recovered only from the artifact's version history and a local backup.

The available fallback is worse: driving a signed-in browser pane to scrape the rendered page takes roughly 70 browser actions per read and depends on that pane staying signed in.

Possibly the same root cause as #38984, #30112, #63182, #19087. Those cover generic custom domains; this report is specifically about artifact reads.

What Should Happen?

With *.frame.claudeusercontent.com present in the environment's Allowed domains, a session started after the change should be able to read a published artifact by URL through the artifact read tool, with no browser fallback.

Error Messages/Logs

Artifact <artifact-id>: this environment's network allowlist blocks <artifact-id>.frame.claudeusercontent.com, and the session gateway could not serve the read either (artifact reads through the session gateway are not enabled for this session, or the artifact service no longer serves this version); your access to the artifact itself is fine (the permission check passed). To allow direct artifact reads here, add *.frame.claudeusercontent.com to the environment's allowed domains: environment settings → Code → Network access → Custom → Allowed domains. An admin can add the same entry to a shared environment from admin settings → Cloud environments; sessions that run in that environment get the access.

Steps to Reproduce

1. In a Cowork session in the Claude desktop app, publish an HTML artifact. Note its URL.
2. Go to claude.ai/code, click the cloud chip above the message box, hover the Default environment and open its settings.
3. Set Network access to Custom, then click Add Artifact content domains. It inserts *.frame.claudeusercontent.com and *.frame.staging.claudeusercontent.com and then greys itself out. Leave "Also include default list of common package managers" checked. Save.
4. Fully quit and reopen the Claude desktop app.
5. Start a new Cowork session.
6. Ask it to read the artifact published in step 1 by URL, with an explicit instruction to use the artifact read tool only and not to fall back to the browser.
7. The read fails with the environment-allowlist error quoted above. Repeated with several fresh sessions over about an hour, with the same result each time.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

N/A

Claude Code Version

2.1.251

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Non-interactive/CI environment

Additional Information

_No response_