Cowork sandbox network allowlist not affected by sandbox.enabled toggle in settings

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

After toggling sandbox.enabled in ~/.claude/settings.json, the Cowork ("dispatch") Linux sandbox stayed network-restricted regardless of the setting. Turning sandbox mode off did not lift the restriction.

Environment

• macOS (Darwin 24.6.0), Claude Code + Cowork mode
• ~/.claude/settings.json -> sandbox.enabled: false, with a populated sandbox.network.allowedDomains (incl. *.cloudflare.com, hazards.fema.gov)
• No /Library/Application Support/ClaudeCode/managed-settings.json present

Steps to reproduce

1. Set sandbox.enabled: true and add domains (e.g. *.cloudflare.com, hazards.fema.gov) to sandbox.network.allowedDomains.
2. In a Cowork session, run a curl loop against those domains from the sandbox shell.
3. Set sandbox.enabled: false.
4. Re-run the loop.

Test loop used:

for u in https://api.cloudflare.com/client/v4 https://cloudflare.com https://www.google.com https://hazards.fema.gov https://registry.npmjs.org; do
  c=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 15 "$u" 2>/dev/null); echo "$c  $u"
done

Actual
In both states, only the platform's built-in allowlist applies. Unlisted domains return curl exit 56 (HTTP 403 from proxy, header X-Proxy-Error: blocked-by-allowlist); listed domains like registry.npmjs.org return 200. Result from inside the Cowork sandbox:

000  https://api.cloudflare.com/client/v4
000  https://cloudflare.com
000  https://www.google.com
000  https://hazards.fema.gov
200  https://registry.npmjs.org

The same loop on the host Mac (CLI, sandbox off) returns normal codes for all five.

Root cause (observed)
The Cowork sandbox enforces egress via an external proxy (localhost:3128) reading a platform policy at /etc/srt-settings.base.json (plus per-request /etc/srt-settings/oneshot-*.json). This policy is independent of ~/.claude/settings.json, so user sandbox settings have no effect on the Cowork sandbox, and there is no user-facing way to change it. The in-sandbox policy file is root-owned and unwritable; sudo is disabled (no-new-privileges).

What Should Happen?

Either honor the user's sandbox settings (sandbox.enabled, sandbox.network.allowedDomains) in Cowork sessions, or clearly document that Cowork's sandbox allowlist is platform-fixed and separate from the CLI's sandbox config — so the settings do not appear to be silently ignored.

Error Messages/Logs

curl: (56) Received HTTP code 403 from proxy after CONNECT
< HTTP/1.1 403 Forbidden
< X-Proxy-Error: blocked-by-allowlist

Inside Cowork sandbox:
000  https://api.cloudflare.com/client/v4
000  https://cloudflare.com
000  https://www.google.com
000  https://hazards.fema.gov
200  https://registry.npmjs.org

Steps to Reproduce

1. In ~/.claude/settings.json, set sandbox.enabled: true and add domains to sandbox.network.allowedDomains (e.g. *.cloudflare.com, hazards.fema.gov).
2. Open a Cowork session and run this loop from the sandbox shell:

``
for u in https://api.cloudflare.com/client/v4 https://cloudflare.com https://www.google.com https://hazards.fema.gov https://registry.npmjs.org; do
c=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 15 "$u" 2>/dev/null); echo "$c $u"
done
``

1. Observe that the domains you allow-listed still return 000 (blocked), while only the platform defaults (e.g. registry.npmjs.org) return 200.
2. Set sandbox.enabled: false and re-run the same loop.
3. Observe the result is unchanged — the Cowork sandbox is still restricted, and the same loop run on the host Mac (CLI, sandbox off) returns normal codes for all five domains.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.260 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_