extension: keep PI_CHROME_AUTHORIZE grants out of the persisted grant

The env grant was saved to globalThis like a /chrome authorize grant. After
a /reload or a session switch (/resume, /fork, /new) the new runtime restored
it, skipped the env branch, and left envGranted false, so the footer
announced a grant the user never gave.

Read the variable again on each session_start instead of persisting it.
A restored grant now always comes from /chrome authorize. A timed env grant
restarts its countdown on each reload or switch.

1 files changed, 3 insertions, 2 deletions

diff --git a/extensions/chrome-profile-bridge/index.ts b/extensions/chrome-profile-bridge/index.ts
index 342493b..6156e81 100644
--- a/extensions/chrome-profile-bridge/index.ts
+++ b/extensions/chrome-profile-bridge/index.ts
@@ -1166,14 +1166,15 @@ export default function (pi: ExtensionAPI): void {
 		await bridge.start();
 		// FORK: PI_CHROME_AUTHORIZE grants every session up front, for setups that want chrome_*
 		// present from the start like any other tool. Same values as /chrome authorize; a grant
-		// that survived /reload is left alone.
+		// that survived /reload is left alone. Not persisted: the variable is still set after a
+		// /reload or session switch, so it is read again, and a restored grant always means the
+		// user gave it through /chrome authorize.
 		const autoGrant = process.env.PI_CHROME_AUTHORIZE?.trim();
 		if (autoGrant && chromeAuthorizedUntil === undefined) {
 			const grant = parseAuthorizeArg(autoGrant);
 			if (grant) {
 				chromeAuthorizedUntil = grant.until;
 				envGranted = true;
-				persistAuth();
 			} else {
 				ctx.ui.notify(`Ignoring PI_CHROME_AUTHORIZE="${autoGrant}": use minutes (15m, 30, 45) or indefinite.`, "warning");
 			}