Cowork: Chrome "Approved sites" domain approval resets every new conversation despite choosing "Always allow"

Summary

In Claude Desktop's Cowork mode, per-site browser approvals ("Approved sites" / "Always allow actions on this site") don't persist across separate Cowork conversations. Every new conversation re-prompts for the same domain, even though it was previously approved with "Always allow" — which the in-app permissions UI describes as permanent until manually removed.

Environment

• Claude Desktop (Cowork): version 1.24012.9
• OS: macOS (Darwin 27.0.0)

Steps to reproduce

1. In a Cowork conversation, trigger a skill/action that navigates Claude-in-Chrome to a not-yet-approved domain.
2. When the "approve this website" prompt appears, choose "Always allow actions on this site" (not the one-time option).
3. Confirm the domain now appears under the extension's Settings → Permissions → "Approved sites" list.
4. Start a new, separate Cowork conversation and trigger the same skill/action against the same domain.

Expected behavior

The new conversation should not re-prompt for a domain already on the "Approved sites" list.

Actual behavior

It prompts again. The "Approved sites" list appears empty/reset relative to the prior conversation's approval, with nothing manually removed.

Additional notes from investigation

• The local Claude Code permission mechanism (ClaudeInChromeDomain(<host>) in ~/.claude/settings.local.json) does not resolve this — separate, insufficient layer.
• No claude.ai/settings/browser-extension page exists (checked — 404), despite some third-party writeups referencing a "default for all sites" toggle there.
• ~/Library/Logs/Claude/chrome-native-host.log (the Desktop↔Chrome-extension bridge log) has no new entries in 5+ days despite Cowork actively driving the browser today — the approval flow likely now runs through a server-mediated path not reflected in that log.
• Cowork's VM sandbox has its own separate allowedDomains allowlist for the sandboxed process's own network egress (visible in cowork_vm_node.log) — unrelated to the Chrome extension's site-approval UI, and hasn't logged new entries since mid-May, so likely not the active code path either.
• Net effect: any Cowork skill relying on browser automation against a fixed set of trusted sites is effectively non-automatable, since a human has to re-approve on every single run.