[BUG] claude-in-chrome MCP server's generic "Prohibited actions" instructions govern unrelated Bash/SSH behavior for the rest of the session

Preflight

• Related, not duplicate: #83702. Same root cause (MCP server instructions are injected unconditionally for the whole session), but that issue is about context/token cost. This one is about incorrect behavior.

Problem

When the claude-in-chrome MCP server is loaded (in my case, enabled by default via Conductor, which wraps Claude Code), its instructions block includes a generic "Action categories" safety framework (Prohibited / Explicit permission required / Regular actions). The language is general, not scoped to browser actions specifically. Example: "Permanently deleting data (emptying trash, hard-deleting files, emails, or messages)" is listed under Prohibited, with no qualifier limiting it to browser-initiated deletions.

In my session, this caused the model to refuse a plain rm command over SSH to delete media files on my own home server, an action with nothing to do with the claude-in-chrome tool. It kept refusing even after I authorized it explicitly, more than once, because the instruction text states the prohibition "stays prohibited when the user explicitly asks for them... or says they authorize it."

Reproduction

1. Start a Claude Code / Conductor session with "Use Claude Code with Chrome" enabled (default-on in Conductor).
2. Ask Claude to run a destructive Bash command (e.g. rm on a file you explicitly name and authorize).
3. Claude cites the claude-in-chrome MCP server's "Prohibited actions" list and refuses, even with explicit repeated authorization.
4. Repeat the same request in an otherwise identical session with Chrome integration disabled (/chrome → toggle off, or never enabled).
5. Claude runs the command normally, citing only project-level instructions (CLAUDE.md), which contain no such blanket prohibition.

Expected behavior

Either:

• (a) claude-in-chrome's safety instructions should be explicitly scoped to browser-initiated actions only, so they don't alter behavior for unrelated tools (Bash, filesystem, SSH), or
• (b) if this is intentional session-wide policy, that should be documented and surfaced to the user (e.g., in /chrome or a settings screen), not silently inherited as an undocumented side effect of enabling a browser tool.

Actual behavior

Loading a browser-automation tool silently and permanently changes the model's willingness to perform unrelated, explicitly authorized filesystem actions for the rest of the session. There's no way to override it short of disabling the browser tool entirely and starting a new session.

Environment

• Claude Code via Conductor (Mac app)
• Model: Claude Sonnet 5
• claude-in-chrome enabled via Conductor's "Use Claude Code with Chrome" toggle (default-on)