Browser pane blocks cross-origin subresources of local multi-domain dev apps (ERR_BLOCKED_BY_CLIENT); Allowed sites list has no effect

Summary

The Browser pane cannot render a local dev app whose page and assets are served from two different local domains. Every cross-origin subresource request is killed with net::ERR_BLOCKED_BY_CLIENT, and nothing the user can configure changes this: the "Allowed sites" list, a pane restart, or registering the app as a dev server in .claude/launch.json all have no effect on resource loading.

Environment

• Claude Code 2.1.251, desktop app, macOS 26.6.2 (arm64)
• Local dev stack: nginx proxy on 127.0.0.1 serving several *.lvh.me hostnames (lvh.me resolves to 127.0.0.1)

Setup

A common multi-domain local dev layout:

• https://app1.lvh.me serves the HTML page (SPA shell)
• https://app2.lvh.me serves the JS/CSS (Vite dev server behind the same nginx)

Both hostnames resolve to 127.0.0.1. The same app loads fine in regular Chrome.

What happens in the pane

1. Navigate the pane to https://app1.lvh.me/... : top-level HTML loads (HTTP 200).
2. The page requests its scripts from https://app2.lvh.me/... : every request fails with net::ERR_BLOCKED_BY_CLIENT (transferSize 0).
3. The app never boots past its loading spinner.

What I tried, none of it helped

1. Added app2.lvh.me (and the app's other runtime domains) to the pane's Allowed sites list. Subresource requests are still blocked. The list appears to govern tool permissions only, not page resource loading.
2. Navigated the pane directly to https://app2.lvh.me/... top-level: loads fine. Subresource requests from the app1 page remain blocked.
3. Opened fresh tabs, then closed all tabs and reopened the pane (full pane restart) after the allowlist change: still blocked.
4. Registered the app in .claude/launch.json as an attach-only dev server ({"name": "app", "url": "https://app1.lvh.me"}) and opened it via preview_start: still blocked.

Expected

One of:

• The Allowed sites list also applies to page resource loading, or
• Origins registered in .claude/launch.json (and the domains they load from) are trusted for subresource requests, or
• A documented way to allow cross-origin subresources for local development.

Why it matters

Multi-domain local setups are common (separate asset/CDN host, auth host, feature-flag host, upload host). Right now none of these apps can render in the pane, which blocks the pane's review and annotation workflow for exactly the kind of local dev work Claude Code is used for. The failure is also silent: no prompt, no pane-side indication, just a spinner and ERR_BLOCKED_BY_CLIENT in the console.