[BUG] Allowed sites list creates duplicate entries for the same origin

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

When adding a site via "Manage allowed sites", the same origin gets added
twice, producing duplicate rows in the list. Reproduced with two different
origins (192.168.5.51:3000 and 192.168.5.52:3000) — each appears twice
after a single add.

Additionally: entries in the allowed-sites list appear to have no effect
while the permission mode is "Bypass permissions" — every browser tool call
still prompts per action, with the message "Site-level permissions are
disabled for this site. You'll be asked for each action." The dialog in that
mode also offers only "Allow once" / "Deny", with no "Allow always" option.
The panel text says the list applies to "Ask and Accept edits modes", so this
may be intended — but the mode named "Bypass permissions" prompting *more*
than the other modes is counterintuitive and worth reviewing.

Environment: Claude Code desktop (Windows 11), browser pane / Claude Browser tools.

### What Should Happen?

Adding a site once via "Manage allowed sites" should create exactly one
entry for that origin. The list should also de-duplicate — re-adding an
origin that is already present should either be a no-op or replace the
existing entry, never append a second identical row.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Open the Browser pane menu (⋮) and choose "Manage allowed sites".
2. In the "Add URL" field, enter a single origin, e.g. 192.168.5.51:3000
3. Click the "+" button once.
4. Click "Done".
5. Reopen "Manage allowed sites".

Observed: the origin appears as two identical rows in the list.
Expected: exactly one row for that origin.

Reproduced with two different origins in the same session
(192.168.5.51:3000 and 192.168.5.52:3000) — both ended up duplicated
after a single add each.

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

Claude 1.34493.1 (255293) 2026-08-21T02:05:20.000Z

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

PowerShell

### Additional Information

_No response_

Start in the Browser pane's “Manage allowed sites” flow and reproduce adding one origin, then reopening the list. Done means a single add produces exactly one row and re-adding does not create duplicates; separately verify whether the reported “Bypass permissions” behavior is intended, since the issue leaves that point open.

Written by the indexing model from the issue text.