extension: keep PI_CHROME_AUTHORIZE grants out of the persisted grant The env grant was saved to globalThis like a /chrome authorize grant. After a /reload or a session switch (/resume, /fork, /new) the new runtime restored it, skipped the env branch, and left envGranted false, so the footer announced a grant the user never gave. Read the variable again on each session_start instead of persisting it. A restored grant now always comes from /chrome authorize. A timed env grant restarts its countdown on each reload or switch.
Igor Soarez igor@soarez.org
Fri, 06 Nov 2026 13:49:39 +0200
1 files changed,
3 insertions(+),
2 deletions(-)
M
extensions/chrome-profile-bridge/index.ts
→
extensions/chrome-profile-bridge/index.ts
@@ -1166,14 +1166,15 @@ sessionCtx = ctx;
await bridge.start(); // FORK: PI_CHROME_AUTHORIZE grants every session up front, for setups that want chrome_* // present from the start like any other tool. Same values as /chrome authorize; a grant - // that survived /reload is left alone. + // that survived /reload is left alone. Not persisted: the variable is still set after a + // /reload or session switch, so it is read again, and a restored grant always means the + // user gave it through /chrome authorize. const autoGrant = process.env.PI_CHROME_AUTHORIZE?.trim(); if (autoGrant && chromeAuthorizedUntil === undefined) { const grant = parseAuthorizeArg(autoGrant); if (grant) { chromeAuthorizedUntil = grant.until; envGranted = true; - persistAuth(); } else { ctx.ui.notify(`Ignoring PI_CHROME_AUTHORIZE="${autoGrant}": use minutes (15m, 30, 45) or indefinite.`, "warning"); }