[BUG] Browser pane per-action permission prompts never persist for non-localhost origins

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In the Claude Desktop Browser pane (embedded browser used by Claude's browser tools), per-action permission prompts ("Allow Claude to access," "Allow Claude to read the page," "Allow Claude to execute JavaScript," etc.) are supposed to be governed by a per-site "Allow site" setting, so that approving a site once stops future prompts for that site. This works correctly for localhost origins, but does not work for any other hostname — including hostnames that resolve to 127.0.0.1 via the local hosts file. On a non-localhost hostname, every single browser action re-triggers its own approval prompt, indefinitely, even after:

• Explicitly adding the exact host (with and without port) to the "Allow site" list multiple times
• Restarting Claude Desktop entirely
• Confirming via the site list UI that the host shows as allowed

Every single action on a non-localhost hostname re-triggers its own prompt, forever, regardless of prior approvals. localhost origins are unaffected and never prompt.

What Should Happen?

Once a site is approved (either via the prompt's "always allow"/persistent option, or via the "Allow site" settings list), subsequent actions on that same site should not re-prompt — matching the behavior already seen on localhost.

Error Messages/Logs

Steps to Reproduce

1. Open the Browser pane and navigate to http://localhost:<port> — confirm no permission prompts occur across repeated navigate/read/click/type/JS actions.
2. Navigate to a non-localhost hostname that resolves locally (e.g. via hosts file) to the same server, such as http://myhost.local:<port>.
3. Approve the first "Allow Claude to access [site]" prompt.
4. Perform a second, unrelated action on the same page/host (e.g. read the page, click something, run JavaScript).
5. Observe that a new approval prompt fires for this new action, on the same already-approved host.
6. Open the Browser pane's own "Allow site" settings screen — confirm the host is listed as allowed (possibly listed multiple times as duplicate entries from repeated approvals — see note below).
7. Repeat steps 3–5 indefinitely — the prompt never stops recurring for this host, no matter how many times it's approved.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.46388.2.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

The "Allow site" list accumulates duplicate entries for the same hostname (e.g. the same hostname appeared 4 times in the list) rather than recognizing it's already present — suggesting the approval-write path isn't correctly checking/deduplicating against existing entries, which may be related to why the approval isn't being honored on read.

[PreviewOriginPolicy] origin prompt (card) decision: allow_always
Config file written
[Preview] cat3 per-action approval requested { origin: 'http://app-one.test', toolName: 'computer', action: 'left_click' }

[Preview] cat3 per-action card suppressed by Allowed-sites trust { origin: 'http://app-two.test', toolName: 'computer', action: 'left_click' }