feat: lazy-register chrome tools until /chrome authorize

Defer all pi.registerTool() calls until /chrome authorize fires.

Previously, 18 chrome_* tool definitions + chrome-profile-bridge
primer consumed ~5K tokens/turn even when Chrome control locked.

Changes:
- Add chromeToolsRegistered flag (default false)
- Wrap all pi.registerTool() calls in registerChromeTools(pi)
- Only register tools when authorizeFor() runs
- Make before_agent_start conditional: primer injected only when
  tools registered AND authorized
- No tools exist in context until user explicitly allows it

Saves ~5,000 tokens/turn when Chrome control is locked.

2 files changed, 36 insertions, 0 deletions

diff --git a/extensions/chrome-profile-bridge/index.ts b/extensions/chrome-profile-bridge/index.ts
index 79b9eb2..4fe5aa3 100644
--- a/extensions/chrome-profile-bridge/index.ts
+++ b/extensions/chrome-profile-bridge/index.ts
@@ -463,6 +463,7 @@ export default function (pi: ExtensionAPI): void {
 	const bridge = new ChromeProfileBridge(DEFAULT_HOST, DEFAULT_PORT);
 	let backgroundDefault = false;
 	let chromeAuthorizedUntil: number | "indefinite" | undefined;
+	let chromeToolsRegistered = false;
 
 	const authSummary = (): string => {
 		if (chromeAuthorizedUntil === "indefinite") return "authorized indefinitely";
@@ -526,6 +527,9 @@ export default function (pi: ExtensionAPI): void {
 	});
 
 	pi.on("before_agent_start", (event) => {
+		if (!chromeToolsRegistered || !chromeControlAuthorized()) {
+			return { systemPrompt: event.systemPrompt };
+		}
 		const primer = `
 <chrome-profile-bridge>
 Chrome control is available through the chrome_* tools via a companion Chrome extension installed in the user's normal Chrome profile. Tools target the existing signed-in profile: no remote-debug port, no throwaway profile.
@@ -649,6 +653,7 @@ Usage rules:
 			ctx.ui.notify("Chrome control remains locked.", "info");
 			return;
 		}
+		registerChromeTools(pi);
 		chromeAuthorizedUntil = until;
 		ctx.ui.notify(`Chrome control authorized for ${label}.`, "info");
 		updateChromeStatus(ctx);
@@ -851,6 +856,10 @@ Usage rules:
 		},
 	});
 
+	function registerChromeTools(pi: ExtensionAPI): void {
+		if (chromeToolsRegistered) return;
+		chromeToolsRegistered = true;
+
 	pi.registerTool({
 		name: "chrome_launch",
 		label: "Chrome Bridge Setup",
@@ -1384,4 +1393,6 @@ Usage rules:
 			return { content: [{ type: "text", text: `Uploaded ${paths.length} file(s) to ${params.uid ?? params.selector}` }], details: { result: result as Json } };
 		},
 	});
+	}
+
 }
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..2d590fa
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,25 @@
+{
+	"name": "pi-chrome",
+	"version": "0.15.21",
+	"lockfileVersion": 3,
+	"requires": true,
+	"packages": {
+		"": {
+			"name": "pi-chrome",
+			"version": "0.15.21",
+			"license": "MIT",
+			"peerDependencies": {
+				"@earendil-works/pi-coding-agent": "*",
+				"typebox": "*"
+			},
+			"peerDependenciesMeta": {
+				"@earendil-works/pi-coding-agent": {
+					"optional": true
+				},
+				"typebox": {
+					"optional": true
+				}
+			}
+		}
+	}
+}