Cowork: "Allow network egress → All domains" is set, but the sandbox 403s every host. Anyone got this to actually apply?

Individuals plan, Windows desktop app, Cowork cloud session. I use it to work on my own PHP site — read the live pages, run lint, deploy changes. It worked fine until a few days ago. Now the sandbox can't reach anything at all. My settings — Settings → Features → Code execution and file creation: "Allow outbound network traffic": ON "Allowed domains list": All domains The UI confirms it in plain text: "Claude can access all domains on the internet." What actually happens inside the sandbox: CONNECT mydomain.tld:443 → HTTP/1.1 403 Forbidden CONNECT docs.claude.com:443 → HTTP/1.1 403 Forbidden CONNECT www.google.com:443 → HTTP/1.1 403 Forbidden curl: (56) CONNECT tunnel failed, response 403 The proxy's own status endpoint logs every one of them: { "kind": "connect_rejected", "detail": "gateway answered 403 to CONNECT (policy denial or upstream failure)", "host": "mydomain.tld:443" } The tell. The only hosts that still work are the ones sitting in no_proxy : pypi.org, files.pythonhosted.org, registry.npmjs.org, jsr.io, index.crates.io, proxy.golang.org. That is exactly the "Package managers only" allowlist. So the sandbox is behaving as if the mode were "Package managers only" while my account setting says "All domains". The setting doesn't appear to reach the sandbox at all — it falls back to the default. What I already ruled out, so nobody has to suggest it: Stale session. Reproduced in a brand new session, created after confirming the setting was on "All domains". Same 403. Cloud-container-specific. The local Cowork VM ( device_bash ) hits the same 403, and DNS there fails with EAI_AGAIN . So it's account-wide, not something about the cloud sandbox. Network partition. A raw TCP connect to my host on port 443 succeeds. The route is fine — it's the gateway refusing the CONNECT. Something specific to my domain. docs.claude.com is blocked too. So is google.com. WebFetch. That one reaches the same host without any problem, so it clearly takes a different path than the sandbox proxy. This looks like the same class of problem as issues #30112, #38984 and #51400 (egress allowlist not enforced), but all of those are Enterprise admin-console reports. I'm on Individuals, where the toggle lives in the app's own Settings, and there's no admin panel to check against. What I'm asking: Has anyone on Individuals or Pro actually got "All domains" to take effect in a Cowork sandbox? Did it need anything beyond flipping the dropdown — a re-login, a new session, a full app restart? Is there a config key that works from claude_desktop_config.json ? I've seen coworkEgressAllowedHosts mentioned in the changelog but I don't know whether it's read on non-managed installs. Did a recent release change the default? Mine used to work, and I didn't change anything on my end. Unrelated but compounding, in case someone else is in the same hole: the Windows update from September 8 also kills device_bash entirely by breaking the Plan9 share attach — KB5124008 on x64, KB5124012 on ARM64, tracked in issue #92958. The VM boots but mounts nothing, and the error surfaces as a generic "Workspace unavailable". Removing the KB does fix that one (pause Windows Update first, or it comes straight back), but it does nothing for the 403. Between the two, there is currently no path at all from a session to my own server.