It's because of a Chrome bug that dynamically granted options will be "forgotten" after Chrome restarts if I set all urls as optional permission. In order to support GitHub Enterprise, which I cannot know the domains in advance, I have to request permission for all domains and deal with script injection myself.

Believe me I did a lot of research to prevent this from happening but it failed...