2.1.217: permissions.allow rules for mcp__claude-in-chrome__* are ignored — every browser action re-prompts

Environment

• Claude Code 2.1.217 (embedded in Claude Desktop 1.24012.1), macOS
• Local session (not remote/VM)

Summary

Since ~2026-07-23, every Claude in Chrome action (mcp__claude-in-chrome__computer, navigate, javascript_tool, etc.) triggers a permission prompt, even though permissions.allow contains mcp__claude-in-chrome (server-scoped form). "Yes, and don't ask again" does not persist — the next action prompts again. No local config changed when this started; it coincides with a server-side feature-flag refresh, so it presents as a silent regression rather than a documented change (nothing in the changelog between 2.1.198, where Claude in Chrome went GA, and 2.1.217 describes it).

Steps to reproduce

1. Add mcp__claude-in-chrome to permissions.allow (user or project settings).
2. In an auto-mode session, have Claude perform a browser action (e.g. computer left_click or navigate).
3. Observe a permission prompt despite the allow rule; choose "don't ask again".
4. Next browser action prompts again.

What I tried — none worked

• mcp__claude-in-chrome and mcp__Claude_Browser in permissions.allow (user + project)
• "Yes, and don't ask again"
• Switching permissions.defaultMode between auto and default
• autoMode.allow prose rules
• env: { "CLAUDE_CHROME_CLASSIFIER_FLOOR": "0" } in settings.json (reaches Bash subprocesses but apparently not the permission evaluator)
• Full restart of Chrome and Claude

What I found inspecting the 2.1.217 bundle

The Chrome-tool permission path forces classification via a "classifier floor":

chromeClassifierFloorEnabled = env.CLAUDE_CHROME_CLASSIFIER_FLOOR ?? <flag: tengu_cowork_chrome_automode_default>

This account is enrolled in experiment cowork_chrome_automode_default_experiment_cli (variation 1 → flag true). When the floor is enabled, a matching permissions.allow rule for a Chrome tool is discarded and the decision falls through to ask — so no allowlist entry can take effect. This path appears independent of permission mode (switching auto↔default does not change it).

Impact

Allowlisting and "don't ask again" are both non-functional for Claude in Chrome, so automated browser workflows prompt on every step.

Request

A working opt-out — either an env var / setting that reaches the permission evaluator, or de-enrollment from the experiment. If CLAUDE_CHROME_CLASSIFIER_FLOOR is the intended override, documenting where it must be set (it does not take effect via settings.json env) would resolve this.