From ff99a4432a3feedfac10d9514ce661a9cb95004c Mon Sep 17 00:00:00 2001 From: Igor Soarez Date: Fri, 6 Nov 2026 13:49:39 +0200 Subject: extension: end a /chrome authorize grant with its session The grant lives on globalThis so /reload keeps it, but nothing cleared it when pi replaced the session in the same process. After /new, /resume or /fork the next session started authorized and announced it in the footer. Drop the saved grant on session_shutdown for new, resume and fork. Reload keeps it. Quit leaves it alone, so a subagent quitting in the same process does not take its parent's grant with it. grant-scope.test.mjs loads the shipped module once per runtime in one shared context, the way pi keeps globalThis across reloads and switches, and checks the tools and the footer after each. It fails on 85b4988, and its /chrome authorize cases fail with only the PI_CHROME_AUTHORIZE fix. --- extensions/chrome-profile-bridge/index.ts | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'extensions/chrome-profile-bridge/index.ts') diff --git a/extensions/chrome-profile-bridge/index.ts b/extensions/chrome-profile-bridge/index.ts index 6156e81..158584d 100644 --- a/extensions/chrome-profile-bridge/index.ts +++ b/extensions/chrome-profile-bridge/index.ts @@ -1204,6 +1204,12 @@ export default function (pi: ExtensionAPI): void { // /reload continues the same session. On exit, give Chrome a bounded opportunity to // close this session's created tabs and ungroup adopted tabs before stopping the broker. if (event?.reason !== "reload") await cleanupAutomationTargetBestEffort(); + // A /chrome authorize grant belongs to this session: /reload keeps it, while /new, /resume + // and /fork start a different session in this process, which must not inherit it. "quit" + // leaves it alone: a subagent quitting in this process must not drop its parent's grant. + if (event?.reason === "new" || event?.reason === "resume" || event?.reason === "fork") { + delete globalState[PI_CHROME_AUTH_KEY]; + } bridge.stop(); if (globalState[PI_CHROME_GLOBAL_KEY]?.token === instanceToken) { delete globalState[PI_CHROME_GLOBAL_KEY]; -- cgit v1.2.3