[BUG] Claude in Chrome tools prompt on every call in Bypass mode; "Always allow" ignored (regression in 2.1.280, desktop Code tab, Windows)

Status Open

Reported on v2.1.280

Maintainer reply None cached

Activity 3 comments · opened Sep 22, 2026

Summary

In a Claude desktop Code tab session running in Bypass permissions mode, every mcp__claude-in-chrome__* tool call raises a desktop permission prompt ("Allow Claude to use Browser batch (claude-in-chrome)?"). Clicking Always allow has no lasting effect: the same tool prompts again on the very next call. No other tool prompts in the same session.

This looks like a regression in Claude Code 2.1.280. The same machine, settings and extension ran hundreds of Chrome tool calls with zero prompts on 2.1.271 and 2.1.275, including one session earlier the same day.

Environment

Windows 11 Home (10.0.26200)
Claude desktop app 2.2553.13.0 (MSIX), Code tab, local session
Claude Code 2.1.280 (bundled by the desktop app)
Claude in Chrome extension paired through the bridge, with 2 Chrome browsers connected
Session permissionMode reported as bypassPermissions by session metadata and in the transcript

Steps to reproduce

Start a local Code tab session in Bypass permissions mode on Claude Code 2.1.280.
Call any Claude in Chrome tool, e.g. list_connected_browsers, tabs_context_mcp or browser_batch.
A permission prompt appears. Click Always allow.
Call the same tool again. It prompts again.

Expected

No prompt in Bypass mode. At minimum, Always allow should persist for the session.

Actual

Every Chrome tool call prompts. The tools are also explicitly allowed in project settings ("mcp__claude-in-chrome__*") and in settings.local.json (individual tool names), and that makes no difference either.

Evidence (desktop `main.log`, IDs trimmed)

"Always allow" followed by a re-prompt for the same tool three seconds later:

12:17:01 Emitted tool permission request … for mcp__claude-in-chrome__tabs_context_mcp
12:17:04 Received permission response …: always (tool: mcp__claude-in-chrome__tabs_context_mcp)
12:17:07 Emitted tool permission request … for mcp__claude-in-chrome__tabs_context_mcp

Bypass mode re-applied successfully, and the next Chrome call still prompted:

12:20:22 [CCD] Set permission mode for session … to bypassPermissions
12:20:49 Emitted tool permission request … for mcp__claude-in-chrome__browser_batch

The first prompt (list_connected_browsers) was emitted before the bridge connection was even established. The ask is being decided client side before the tool runs, not by the extension's site permissions.

Version comparison (same machine and settings)

| Claude Code | Chrome tool calls in Bypass mode | Permission prompts |
| --- | --- | --- |
| 2.1.270 (2026-09-14) | yes | 19, same pattern ("always" ignored) |
| 2.1.271 (2026-09-15 to 09-18) | hundreds | 0 |
| 2.1.275 (2026-09-18 to 09-22) | hundreds, including a heavy-use session on 09-22 | 0 |
| 2.1.280 (2026-09-22) | a handful | every call |

So the 2.1.270 behavior was fixed in 2.1.271 and appears to be back in 2.1.280.

Unrelated, for anyone who hits the same screen

The "Permission mode couldn't…" toast that can appear alongside this comes from the "Try auto mode" tip. It fails with Cannot set permission mode to auto: auto mode disabled by settings when disableAutoMode is set, and it is not the cause.

View original on GitHub ↗

3 Comments

dzhokhov · 20 days ago

Same on macOS: Claude desktop app, Code tab, bundled Claude Code 2.1.280 (2.1.275 was fine). After the update, Claude in Chrome tool calls started prompting on every action; before, there were no prompts at all.

SAlexStork · 19 days ago

Root cause, from reading the 2.1.281 bundle (it still reproduces there):

In Bypass (and auto) mode, the per-tool permission-mode resolver gives claude-in-chrome tools a floor. Their effective mode becomes auto if the auto-mode classifier can run, otherwise default, and default prompts on every call. The floor applies when chromeClassifierFloorEnabled is true, which reads CLAUDE_CHROME_CLASSIFIER_FLOOR and falls back to the GrowthBook flag tengu_cowork_chrome_automode_default. While the floor is on, whole-tool allow rules for Chrome tools are skipped, which is why mcp__claude-in-chrome__* in settings and the Always allow button have no effect.

Auto mode isn't available on my account (Cannot set permission mode to auto: auto mode is unavailable for your plan), so the floor never reaches the classifier and lands on default. The version pattern (2.1.271/2.1.275 clean, 2.1.270/2.1.280/2.1.281 prompting) is probably the flag rollout rather than the builds.

Workaround: add "env": {"CLAUDE_CHROME_CLASSIFIER_FLOOR": "0"} to ~/.claude/settings.json and start a new session. That turns the floor off and restores the earlier behavior, including removing the classifier layer for Chrome tools. I've applied it but haven't confirmed it in a fresh session yet.

Suggested fix: when the classifier can't run, fall back to the session's Bypass mode, or at least honor explicit allow rules, instead of prompting on every call.

joeyorlando · 16 days ago