[BUG] Browser pane per-action permission prompts never persist for non-localhost origins

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

In the Claude Desktop Browser pane (embedded browser used by Claude's browser tools), per-action permission prompts ("Allow Claude to access," "Allow Claude to read the page," "Allow Claude to execute JavaScript," etc.) are supposed to be governed by a per-site "Allow site" setting, so that approving a site once stops future prompts for that site. This works correctly for localhost origins, but does not work for any other hostname — including hostnames that resolve to 127.0.0.1 via the local hosts file. On a non-localhost hostname, every single browser action re-triggers its own approval prompt, indefinitely, even after:

• Explicitly adding the exact host (with and without port) to the "Allow site" list multiple times
• Restarting Claude Desktop entirely
• Confirming via the site list UI that the host shows as allowed

Every single action on a non-localhost hostname re-triggers its own prompt, forever, regardless of prior approvals. localhost origins are unaffected and never prompt.

### What Should Happen?

Once a site is approved (either via the prompt's "always allow"/persistent option, or via the "Allow site" settings list), subsequent actions on that same site should not re-prompt — matching the behavior already seen on localhost.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Open the Browser pane and navigate to http://localhost: — confirm no permission prompts occur across repeated navigate/read/click/type/JS actions.
2. Navigate to a non-localhost hostname that resolves locally (e.g. via hosts file) to the same server, such as http://myhost.local:.
3. Approve the first "Allow Claude to access [site]" prompt.
4. Perform a second, unrelated action on the same page/host (e.g. read the page, click something, run JavaScript).
5. Observe that a new approval prompt fires for this new action, on the same already-approved host.
6. Open the Browser pane's own "Allow site" settings screen — confirm the host is listed as allowed (possibly listed multiple times as duplicate entries from repeated approvals — see note below).
7. Repeat steps 3–5 indefinitely — the prompt never stops recurring for this host, no matter how many times it's approved.

### Claude Model

Sonnet (default)

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

1.46388.2.0

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

Other

### Additional Information

The "Allow site" list accumulates duplicate entries for the same hostname (e.g. the same hostname appeared 4 times in the list) rather than recognizing it's already present — suggesting the approval-write path isn't correctly checking/deduplicating against existing entries, which may be related to why the approval isn't being honored on read.

Reproduce in the Claude Desktop Browser pane on Windows by comparing localhost with a hosts-file hostname that resolves locally. Start by finding the Browser pane permission prompt and "Allow site" settings persistence/read paths. Done means an approved non-localhost origin stops re-prompting for later actions and the allow list no longer gains duplicate entries.

Vom Indexierungsmodell aus dem Issue-Text verfasst.