feat(agents): configure Claude Desktop egress hosts

[henrikbroselid]

Summary

• generate coworkEgressAllowedHosts for Claude Desktop 3P profiles with an explicit, non-wildcard default allowlist
• preserve existing custom host entries when the integration is reapplied, while allowing users to edit or reset the list from the Agents page
• validate Claude Desktop's accepted *, localhost, host[:port], and *.host[:port] forms in both the UI and Rust backend
• document that the setting controls tool egress for both Cowork tasks and Claude Code sessions

Why

EasyCLIProxyAPI originally generated coworkEgressAllowedHosts: ["*"], then removed the field to avoid an unrestricted default. Omitting it also prevents sandboxed tools from reaching anything beyond the inference endpoint, so package installs, shell network access, and web fetches fail unless the profile is edited manually.

This change keeps the safer intent without disabling useful egress. New profiles use these explicit defaults:

• localhost
• 127.0.0.1
• api.anthropic.com
• github.com
• *.github.com
• *.githubusercontent.com
• gitlab.com
• *.gitlab.com

A bare * is still accepted for compatibility, but the UI warns that it disables the network sandbox restriction. Existing valid profile values take precedence when an older caller omits the new option, and the current profile is loaded back into the UI so machine-specific additions survive reapplication.

Implementation notes

• Backend validation rejects schemes, paths, IPv6 literals, malformed wildcards, whitespace, and ports outside 1..=65535; valid entries are trimmed, lowercased, and deduplicated in stable order.
• Validation happens before managed model aliases are updated, avoiding partial configuration changes on bad input.
• Missing egress configuration is surfaced as a pending update for an already-applied Claude Desktop integration.
• Existing backup, restore, and managed-key cleanup behavior remains unchanged.

Tests

• bun test — 147 passed
• bun run check
• bun run build
• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test -q claude_desktop_ — 13 passed
• cargo test -q -- --skip agent_probe_command_stops_at_timeout — 236 passed; the existing Unix timeout test was skipped because its sh -c "sleep 5" child retains the captured pipes in the Linux Docker test environment and consistently trips the unrelated 3-second wall-clock assertion

🤖 Generated with Claude Code