"Always allow" for a browser origin does not persist across scheduled task runs

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Re-filing anthropics/claude-code#30356, which was closed as not planned inRe-filing anthropics/claude-code#30356, which was closed as not planned in March 2026. It still reproduces on the current version, and I have two findings that were not in the original report (see below). Filing fresh rather than commenting on a closed issue so it reaches triage; happy for this to be merged back into #30356 if you prefer.

Also related but distinct: #47180 covers Cowork folder/tool permissions. In my case tool permissions DO persist correctly and only the browser origin grant fails, so I believe these are two different bugs.

A recurring scheduled task navigates to framer.com via Claude in Chrome to read a value from the account's Usage page, which requires being logged in. The first run prompts "Allow Claude to navigate to framer.com?" and I click Always allow. Every subsequent scheduled run prompts again, so the task cannot run unattended.

Tool approvals from that same first run persist correctly: they are saved against the task and reapplied automatically on later runs. Only the per-origin browser grant fails to persist. The dialog says "Revoke in Settings", which implies a stored grant, but it is not applied on the next scheduled run.

Adding the browser tools to permissions.allow in settings.json does not help, since those rules cover the tool and not the per-origin gate.

Chrome-level site access for the extension is already set to "On all sites" (Claude in Chrome 1.0.91), so this is not Chrome withholding access. The re-prompt comes from the extension's own per-origin permission layer.

There is no API workaround in this case. Framer exposes no public usage or billing endpoint, and the Usage page receives these figures over a WebSocket rather than REST, so driving the logged-in page is the only way to read the value. The result is that an otherwise fully automated daily check needs one manual click per run.

### What Should Happen?

"Always allow" on an origin should persist across scheduled runs, the same way tool approvals already do, so the task runs unattended after a single approval.

### Error Messages/Logs

```shell
No error output. Nothing fails or throws. The run simply pauses on the
permission dialog and waits for input, so an unattended run never proceeds
past it.
```

### Steps to Reproduce

1. Sign in to a site that requires authentication in Chrome, with the Claude
in Chrome connection active. I used framer.com.

2. Create a recurring scheduled task (cron `0 11,15 * * 1-5`) whose prompt
tells Claude to navigate to that site using Claude in Chrome and read text
from the page with get_page_text.

3. Trigger the first run. A dialog appears: "Allow Claude to navigate to
framer.com?". Click "Always allow". Also click "Always allow" on any tool
permission prompts raised during that same run.

4. Let the task fire again on its schedule, or set a one-time run a few
minutes out, which executes in a fresh session.

5. Observe: the origin dialog appears again and the run waits. The tool
approvals from step 3 are NOT re-prompted, so those persisted correctly.
Only the per-origin browser grant was lost.

Step 5 is the whole report: two permission layers were approved in the same
run, and only one of them was remembered.

### Claude Model

Opus

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.250 (Claude Code)

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

Terminal.app (macOS)

### Additional Information

Scheduled runs appear to execute in a fresh session, which may be relevant. I have not verified whether the grant fails when written or when read back.

Start by reproducing the scheduled task with cron 0 11,15 * * 1-5, Claude in Chrome, and get_page_text. Inspect settings.json and compare how tool approvals and the per-origin browser grant are written and restored between fresh sessions. Done means one “Always allow” approval for framer.com is honored on later scheduled runs without another prompt.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.