[BUG] Site permissions ("Allow all websites") ignored by the built-in browser in Claude Code Desktop

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Title: Site permissions ("Allow all websites") are ignored by the built-in
browser in Claude Code Desktop — permission dialog on every javascript_tool call

## Summary

Settings → Claude in Chrome → Website permissions is set to "Allow all
websites" with an empty block list. The help text under that section states
explicitly:

"These permissions apply to Claude in Chrome and the built-in browser in
Claude Code Desktop and Cowork."

Despite this, the built-in browser in Claude Code Desktop asks for
confirmation on every single tool call, showing:

"Website permissions are disabled for this website. You will be asked for
every action."

So the dialog contradicts the setting it refers to.

## Expected

With "Allow all websites" enabled and the site not on the block list, the
built-in browser should not prompt per action.

## Actual

A confirmation dialog appears on every call. Confirmed for
mcp__Claude_Browser__javascript_tool; occurs across multiple projects and is
not specific to one site.

## Steps to reproduce

1. Settings → Claude in Chrome → Website permissions → "Default for all
websites" = "Allow all websites", block list empty.
2. Restart the app.
3. In Claude Code Desktop, open any site in the built-in browser pane.
4. Have Claude run a javascript_tool call (e.g. `document.title`).
5. → Permission dialog appears, citing disabled website permissions.

## Already ruled out

- Tool allowlist: mcp__Claude_Browser__javascript_tool is present in
permissions.allow in ~/.claude/settings.json (set 2026-08-18).
- App restarted several times; no effect.
- Not project-specific: reproduced across several projects.
- Not site-specific: the block list is empty.
- Not dependent on what the script does — plain DOM reads and fetch calls
(GET and POST) all trigger the dialog.
- No per-site override exists in ~/.claude/settings.json,
~/.claude/settings.local.json or ~/.claude.json (searched for site/domain
permission keys; none found), so the setting cannot be corrected from the
config files either.

## Environment

- Claude Desktop app: 1.40609.1
- Claude Code CLI: 2.1.76
- macOS 26.5.1 (build 25F80)
- Site under test: local development domain (*.test via Laravel Herd),
also observed on other projects/sites

## Impact

Every browser-based verification step requires a manual click. During a
single working session this amounts to dozens of dialogs, which defeats the
purpose of the permission setting.

## Note

There appears to be no way for the agent to detect whether a dialog was
shown — the tool result is identical whether the call passed through or the
user confirmed a prompt. That made this issue considerably harder to
diagnose, and it may be worth surfacing that state in the tool result.

Settings → Claude in Chrome → Website permissions is set to "Allow all websites" with an empty block list. The help text in that section states explicitly: "These permissions apply to Claude in Chrome and the built-in browser in Claude Code Desktop and Cowork."

Despite this, the built-in browser pane in Claude Code Desktop asks for confirmation on every single tool call, showing "Website permissions are disabled for this website. You will be asked for every action." The dialog therefore contradicts the setting it refers to.

The setting cannot be corrected from config files either: there is no per-site or site-permission key in ~/.claude/settings.json, ~/.claude/settings.local.json or ~/.claude.json. The tool itself is allowed — mcp__Claude_Browser__javascript_tool is listed in permissions.allow.

This is not project- or site-specific: it reproduces across several different projects. Restarting the app repeatedly has no effect. It is also independent of what the script does — plain DOM reads (document.title) and fetch calls (both GET and POST) all trigger the dialog.

Impact: every browser-based verification step needs a manual click. Over one working session this adds up to dozens of dialogs, which defeats the purpose of the permission setting.

Side note that made this hard to diagnose: there appears to be no way for the agent to tell whether a dialog was shown. The tool result is identical whether the call passed through or the user confirmed a prompt. Surfacing that in the tool result would help.

### What Should Happen?

With "Allow all websites" enabled and the site not on the block list, the built-in browser in Claude Code Desktop should execute tool calls without prompting per action — as the help text under Website permissions promises.

### Error Messages/Logs

```shell
Permission dialog shown on every call:

"Möchtest du Claude erlauben, JavaScript ausführen auf ?"
"Website-Berechtigungen sind für diese Website deaktiviert. Du wirst für jede Aktion gefragt."

(EN: "Website permissions are disabled for this website. You will be asked for every action.")

Current setting at the same time:
Settings → Claude in Chrome → Website permissions
Default for all websites: "Allow all websites"
Blocked sites: (empty)
```

### Steps to Reproduce

Permission dialog shown on every call:

"Möchtest du Claude erlauben, JavaScript ausführen auf ?"
"Website-Berechtigungen sind für diese Website deaktiviert. Du wirst für jede Aktion gefragt."

(EN: "Website permissions are disabled for this website. You will be asked for every action.")

Current setting at the same time:
Settings → Claude in Chrome → Website permissions
Default for all websites: "Allow all websites"
Blocked sites: (empty)

### Claude Model

Opus

### Is this a regression?

No, this never worked

### Last Working Version

_No response_

### Claude Code Version

2.1.76

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

Terminal.app (macOS)

### Additional Information

_No response_

Start by reproducing the prompt with Settings → Claude in Chrome → Website permissions set to Allow all websites, then compare ~/.claude/settings.json, ~/.claude/settings.local.json, and ~/.claude.json with the mcp__Claude_Browser__javascript_tool call. Trace the built-in browser permission path from that entry point; done means allowed sites no longer prompt per action and blocked sites still do.

由索引模型根据 Issue 内容生成。