feat: integrate pi-chrome with tool search

AGENTS.md

@@ -31,6 +31,7 @@
 - `extensions/permission-system.ts`：直接加载仓库内 `pi-permission-system/src/index.ts`，并在权限扩展注册前将 `config/pi-permission-system.json` 同步为全局权威配置。
 - `extensions/lsp.ts`：把组合包内 TypeScript Language Server CLI 物化为绝对命令路径，部署 TypeScript/Kotlin/JDT LS 全局配置并加载 `pi-lsp`。
 - `extensions/tool-routing.ts`：保留 Pi 默认系统提示词，在每轮开始前按激活工具追加简短路由规则，并提供 `/dump-system-prompt` 将扩展所见的有效提示词写入 `.pi-debug/effective-system-prompt.md`。
+- `pi-chrome@0.15.46`：直接加载上游 Chrome Profile Bridge，通过用户安装的 unpacked MV3 扩展与 `127.0.0.1:17318` loopback bridge 接管当前已登录 Chrome；控制默认锁定，每个 Pi session 必须显式 `/chrome authorize`。
 - `pi-tool-search/`：从上游 `v0.3.6` 源码导入并由本仓库直接维护；从完整工具定义生成并缓存经过校验的 Tool Cards/工作流分组，通过固定工具 + 有界动态组 LRU 加载当前 Pi 的原始 schema。
 - 上游来源：<https://github.com/tuansondinh/pi-tool-search>
 - 初始导入快照：`ddfb23646fd3957b791214de278e23aa393c9b13`（`v0.3.6`）。
@@ -54,7 +55,7 @@
 - 初始导入快照：`f1d0efd24a7f4ae99d19e10c5f4c3770a3bdd845`（`@firstpick/pi-extension-codex-fast-mode@0.1.1`）。
 - 该目录从上游源码仓库导入并由本仓库直接维护，不使用 npm 预编译产物，不是 submodule，也不保留嵌套 `.git`。
 - `pi-condense@2.9.1`：总结已完成的工具调用批次，以短 stub 替换历史原始输出，并通过 `context_tree_query` 按需恢复；组合包在用户尚未配置 `contextPrune.enabled` 时默认开启。
-- 根包还固定安装 `@tavily/pi-extension@0.1.2`、`@keenable/pi-search@0.1.2`、`pi-hashline-edit@0.8.3`、`typescript-language-server@5.3.0`、`typescript@6.0.3` 和 `pi-context-view`；`@firstpick/pi-extension-codex-fast-mode`、`@gotgenes/pi-permission-system`、`pi-ask-user`、`pi-minimal-footer`、`pi-ssh` 与 `pi-tool-search` 分别指向仓库内对应目录的本地 `file:` 依赖。
+- 根包还固定安装 `@tavily/pi-extension@0.1.2`、`@keenable/pi-search@0.1.2`、`pi-chrome@0.15.46`、`pi-hashline-edit@0.8.3`、`typescript-language-server@5.3.0`、`typescript@6.0.3` 和 `pi-context-view`；`@firstpick/pi-extension-codex-fast-mode`、`@gotgenes/pi-permission-system`、`pi-ask-user`、`pi-minimal-footer`、`pi-ssh` 与 `pi-tool-search` 分别指向仓库内对应目录的本地 `file:` 依赖。
 - `install.sh`：先安装根组合包，再交互检查 Hippo Memory CLI、Kitty/Solarized Dark、Oh My Zsh/Powerlevel10k/Zsh 插件、CodeGraph、Kotlin LSP、Java 21+ 和 JDT LS；缺失项目只在用户明确选择 `Y` 后安装或配置。Hippo 项目目录与 `hippo init` 始终由用户自行决定。Powerlevel10k 默认配置来自仓库内置的 `config/p10k.zsh`（当前 Rainbow/ASCII 单行紧凑主题）。
 - `update.sh`：先通过 `pi update` 升级根组合包，再只升级当前已安装的终端环境和机器级依赖；未安装项直接跳过。升级前先查询并比较本地与远端版本，只有版本不同时才下载或替换；Powerlevel10k 配置优先从 `pi update` 后的已安装组合包读取，并与 `.zshrc` 受管块一起按内容比较后增量同步。
 - `uninstall.sh`：先移除根组合包；若检测到 Hippo Memory CLI，再明确询问是否卸载确认属于 npm 全局安装的 `hippo-memory`，默认保留且始终不删除 `.hippo/` 或用户记忆数据。其他共享终端环境和机器工具不卸载。
@@ -71,6 +72,7 @@
 - 工具路由规则不得替换 Pi 默认系统提示词：代码结构、调用关系和待修改 symbol 优先 CodeGraph，定义/引用/类型/诊断优先 LSP；工作区内大文件探索、分析和总结优先 `ctx_execute_file`，日志、构建与不可预测命令输出优先 Context Mode；字面搜索先用 FFF `find` 收敛文件位置，再在收敛路径内用 `grep`/`multi_grep` 获取行号；真正修改前才用小范围 Hashline `read` 获取新鲜锚点并用锚定 `edit`。在线搜索按场景只先选一个服务：广泛发现、新闻和候选来源用 Tavily，官方/技术/论文和高确定性来源用 Exa，中文、站点限定和日期筛选用 Keenable；只有必要时才跨服务复核。遇到大量结果、截断或上限时继续缩小范围，不得靠提高 limit 或倾倒全部结果解决。
 - `ask_user_question` 只用于模型继续任务所必需的用户决定、偏好、确认或澄清；不得重复询问直接用户消息中已有的信息。工具仅支持交互式 TUI、顺序执行和最多 8 题；取消或 abort 必须返回 `cancelled: true`，不得伪造答案，且 `/qna` 不属于该扩展。其成功 `details.answers` 必须保留 `question` / `answer` 字段，以匹配 AutoReview 已有的可信结构化用户交互边界。
 - Tool Search 默认常驻核心 `read` / `write` / `edit` / `bash` / `grep` / `find`、`codegraph_explore`、`lsp_diagnostics` 与 `tool_search`；其余组合包工具必须优先使用 `pi-tool-search/extensions/bundle-groups.ts` 中提交的权威工作流分组。默认最多 3 个动态组、模型组最多 8 个工具、动态工具总数最多 20，加载或组内调用更新 LRU，超限先移除最久未用组。
+- `pi-chrome` 在未授权时不注册 Chrome 工具；显式授权后出现的 21 个 `chrome_*` 工具必须由 Tool Search 分入 `chrome-navigation`、`chrome-interaction`、`chrome-debugging`，不得落入 unknown-tools 模型增强路径。Tool Search 重新激活 schema 不能替代上游每次执行时的授权校验。
 - 标准组合包工具全部命中预置目录时 Tool Search 不得调用模型、创建用户缓存或发送隐藏 schema。只有存在未识别第三方工具时才允许惰性模型增强；生成结果必须保留全部预置 assignment，模型元数据不得替代真实名称、参数或 schema。缓存必须位于 agent 目录且权限 `600`；模型失败必须继续使用预置目录 + 确定性未知工具分组。`groupOverrides` 优先级高于预置分组。
 - Tool Search 必须直接使用当前 `@earendil-works/pi-coding-agent`、`typebox`、`ModelRegistry.complete()` 和 `setActiveTools()`；首次纯增加载使用当前 Pi 的增量结果传播，LRU 替换允许走宿主安全 fallback。不得安装或映射旧 `@mariozechner` runtime，不得恢复 provider payload 改写、代理分发或隐藏 `sendMessage` steer/retry 兼容循环。
 - `.pi-debug/` 是 `/dump-system-prompt` 生成的本地诊断目录，不提交到仓库，也不作为组合包运行时配置源。
@@ -182,7 +184,7 @@
 - SSH 工具的权限预览必须包含连接请求或当前远端的 host id、target、port、remote cwd 与有界操作摘要；连接预览只解密本地 vault 以提取非秘密目标字段，绝不包含凭据，远端 shell 的完整命令继续由 Bash payload 单独提供。权限服务缺失或注册失败时必须 fail-safe，不得转为无提示自动允许。
 - `pi-ssh` 只用于从本地项目显式操作服务器，不得自动探测、读取或向系统提示词注入远端 `AGENTS.md`、`CLAUDE.md` 或其他项目说明；远端内容只能由明确且已授权的 `ssh_*` 工具调用获取。
 - 修改 SSH transport、vault、导入、权限集成或加载入口后至少运行 `pi-ssh` 包内 `npm test`、根脚本语法与 mock 配置测试、`pi-permission-system` 的 `npm run typecheck` / `npm run test` / `npm run build`、根扩展联合加载和实际 packed tarball 隔离安装验证。未经明确要求不得连接真实服务器或把真实密码写入测试。
-- 根加载顺序必须保持 `pi-permission-auto-review` → `pi-permission-system` → `pi-ssh` → `pi-tool-search`，确保 authorizer 先注册、权限服务先发布、SSH 桥接随后安装且 Tool Search 最后收集完整工具目录。
+- 根加载顺序必须保持 `pi-permission-auto-review` → `pi-permission-system` → `pi-ssh` → `pi-chrome` → `pi-tool-search`，确保 authorizer 先注册、权限服务先发布、SSH 桥接随后安装，Chrome 工具可在授权后进入目录，且 Tool Search 最后收集完整工具目录。
 
 
 ## `pi-ask-user` 开发约定

README.md

@@ -17,6 +17,7 @@
 - `pi-condense@2.9.1`：把已完成的工具调用批次总结为可恢复的短摘要，并通过 `context_tree_query` 按需取回原始输出；组合包首次加载时默认开启。
 - 本仓库维护的 `pi-ask-user`：提供模型主动调用的 `ask_user_question`，用一个顺序 TUI 同时支持单题、多题、选择题、文本题、自定义回答与提交前复核。
 - 本仓库维护的 `pi-tool-search`：从完整工具定义生成并缓存经过校验的工作流分组，以最多 3 个动态组的 LRU 策略按组加载原始完整 schema。
+- `pi-chrome@0.15.46`：通过显式会话授权接入用户当前已登录的 Chrome Profile，并由 Tool Search 按导航观察、页面交互和调试上传三个工作流按需加载 21 个 `chrome_*` 工具。
 - 本仓库维护的 `pi-permission-auto-review`：作为 `pi-permission-system` authorizer，使用 Codex Guardian 风格策略自动复核 `ask` 请求。
 - 本仓库维护的 `pi-permission-system`：从 `@gotgenes/pi-permission-system@26.2.1` 源码导入，负责工具、路径、MCP、硬拒绝和兜底权限基线。
 - 本仓库维护的 `pi-ssh`：通过纯 Node `ssh2` 持久连接、SFTP 与自适应有界搜索提供 `ssh_connect`、`ssh_read`、`ssh_write`、`ssh_edit`、`ssh_find`、`ssh_grep`、`ssh_bash`；Agent 只在用户明确指定已导入主机及具体任务后发起受 AutoReview 复核的连接。
@@ -137,13 +138,19 @@ CodeGraph 本体不由组合包安装。需要使用 CodeGraph 的机器应自
 
 使用 `/dump-system-prompt` 可将当前扩展所见的有效提示词写入当前项目的 `.pi-debug/effective-system-prompt.md`。`.pi-debug/` 属于本地诊断输出，默认不提交。
 
+### 接管当前 Chrome
+
+组合包固定加载 `pi-chrome@0.15.46`，但不会自动取得浏览器控制权。首次安装后在 Pi 中运行 `/chrome onboard`，按提示在 `chrome://extensions` 以 Developer mode 加载组合包内的 unpacked Chrome 扩展，再执行 `/reload` 与 `/chrome doctor`。每个 Pi session 仍需由用户显式运行 `/chrome authorize`；可用 `/chrome revoke` 立即撤销。Bridge 只监听 `127.0.0.1:17318`，Chrome 扩展具有广泛的 tabs/scripting/debugger 权限，应只从可信组合包安装。
+
+授权后注册的 21 个 `chrome_*` 工具不会常驻提示词；Tool Search 将它们分为 `chrome-navigation`、`chrome-interaction` 和 `chrome-debugging`。普通网页资料发现仍使用 Tavily/Exa/Keenable，只有需要读取登录态页面或实际操作当前 Chrome 时才加载 Chrome 组。
+
 ### 按需加载工具 schema
 
 `pi-tool-search/` 从上游 <https://github.com/tuansondinh/pi-tool-search> 的 `v0.3.6`、commit `ddfb23646fd3957b791214de278e23aa393c9b13` 导入，并像 `pi-rtk-optimizer/` 一样由本仓库直接维护；它不是 submodule，不加载 npm 预编译入口，也不保留嵌套 `.git`、上游 `.pi` 状态或构建产物。来源、许可证说明和本地差异记录在 `pi-tool-search/UPSTREAM.md`。
 
 本地源码直接使用 `@earendil-works/pi-coding-agent`、当前 `typebox`、`ModelRegistry.complete()` 与 `setActiveTools()`，不安装、别名映射或加载旧 `@mariozechner` runtime，也不使用 provider payload 改写、代理执行或隐藏 `sendMessage` 循环。
 
-新 session 默认常驻 Pi 核心 `read`、`write`、`edit`、`bash`、`grep`、`find`，以及 `codegraph_explore`、`lsp_diagnostics` 和 `tool_search`。组合包在 `pi-tool-search/extensions/bundle-groups.ts` 中为自身暴露的工具预置权威分组，包括本地文件导航、SSH 远端文件/命令、用户交互、CodeGraph/LSP、Tavily、Exa、Keenable、Context Mode 执行/知识库/观测/管理、Memory 查询/维护、Skill 和 MCP 管理。不可用的可选工具会自动从组中滤除，固定工具也不占动态组额度。
+新 session 默认常驻 Pi 核心 `read`、`write`、`edit`、`bash`、`grep`、`find`，以及 `codegraph_explore`、`lsp_diagnostics` 和 `tool_search`。组合包在 `pi-tool-search/extensions/bundle-groups.ts` 中为自身暴露的工具预置权威分组，包括本地文件导航、SSH 远端文件/命令、Chrome 导航/交互/调试、用户交互、CodeGraph/LSP、Tavily、Exa、Keenable、Context Mode 执行/知识库/观测/管理、Memory 查询/维护、Skill 和 MCP 管理。不可用或尚未授权而未注册的可选工具会自动从组中滤除，固定工具也不占动态组额度。
 
 标准组合包的全部隐藏工具都能命中预置目录，因此首次使用不调用模型、不生成用户缓存，也不把完整隐藏 schema 发送给 provider。只有用户另外安装了未识别工具时，才先为新增工具提供确定性分组，并可在第一次 `tool_search` 时使用当前已认证模型补充目录；模型结果必须保留组合包预置分组，否则直接拒绝。有效增强缓存以 `0600` 写到 agent 目录的 `tool-search/catalog-v1.json`，调用用量计入工具结果。用户 `groupOverrides` 的优先级高于预置目录；`/tool-search-rebuild` 会立即恢复预置目录，只有仍存在额外工具时才可能在下次搜索惰性增强。
 

package-lock.json

@@ -18,6 +18,7 @@
         "context-mode": "1.0.169",
         "jiti": "2.7.0",
         "pi-ask-user": "file:./pi-ask-user",
+        "pi-chrome": "0.15.46",
         "pi-condense": "2.9.1",
         "pi-context-view": "0.4.2",
         "pi-hashline-edit": "0.8.3",
@@ -5664,6 +5665,24 @@
       "resolved": "pi-ask-user",
       "link": true
     },
+    "node_modules/pi-chrome": {
+      "version": "0.15.46",
+      "resolved": "https://registry.npmjs.org/pi-chrome/-/pi-chrome-0.15.46.tgz",
+      "integrity": "sha512-4ZG4h4F3OkAwb9Os2LAiMAFqCGdr6cgUZSna0d6L+cR8eUDvI537UMuqLrf4sepy7US5rk3W0dvqy19KGfK3IQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@earendil-works/pi-coding-agent": "*",
+        "typebox": "*"
+      },
+      "peerDependenciesMeta": {
+        "@earendil-works/pi-coding-agent": {
+          "optional": true
+        },
+        "typebox": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/pi-condense": {
       "version": "2.9.1",
       "resolved": "https://registry.npmjs.org/pi-condense/-/pi-condense-2.9.1.tgz",

package.json

@@ -63,6 +63,7 @@
       "./extensions/permission-system.ts",
       "./pi-ssh/index.ts",
       "./pi-ask-user/index.ts",
+      "./node_modules/pi-chrome/extensions/chrome-profile-bridge/index.ts",
       "./extensions/tool-routing.ts",
       "./pi-tool-search/extensions/index.ts"
     ],
@@ -81,12 +82,13 @@
     "@tavily/pi-extension": "0.1.2",
     "context-mode": "1.0.169",
     "jiti": "2.7.0",
+    "pi-ask-user": "file:./pi-ask-user",
+    "pi-chrome": "0.15.46",
     "pi-condense": "2.9.1",
     "pi-context-view": "0.4.2",
     "pi-hashline-edit": "0.8.3",
     "pi-lsp": "0.1.7",
     "pi-mcp-adapter": "2.26.0",
-    "pi-ask-user": "file:./pi-ask-user",
     "pi-ssh": "file:./pi-ssh",
     "pi-tool-search": "file:./pi-tool-search",
     "ssh2": "1.17.0",

pi-tool-search/CHANGELOG.md

@@ -13,6 +13,7 @@
 - Replaced the Hermes and third-party Hippo assignments with the five tools exposed by the official Hippo Pi extension, grouped into recall and management workflows.
 - Added authoritative `ssh-connection`, `ssh-remote-files`, `ssh-remote-search`, and `ssh-remote-shell` groups for the maintained `pi-ssh` tools, keeping reviewed connection, bounded discovery, structured file operations, and reviewed shell execution separate.
 - Added the authoritative `user-interaction` group for the maintained `ask_user_question` TUI tool.
+- Added authoritative `chrome-navigation`, `chrome-interaction`, and `chrome-debugging` groups for all 21 tools registered by the pinned `pi-chrome` bridge after explicit session authorization.
 
 ## [0.3.6] - 2026-04-24
 

pi-tool-search/README.md

@@ -42,6 +42,9 @@ Run `/tool-search-rebuild` to remove model enrichment. Standard bundle tools imm
 | `memory-recall` | Official Hippo recall/context/status and condensed-output recovery |
 | `memory-management` | Official Hippo remember/outcome tools |
 | `user-interaction` | `ask_user_question` model-initiated TUI questions |
+| `chrome-navigation` | Chrome bridge setup, tabs, navigation, snapshots/find/inspect, waits, and screenshots |
+| `chrome-interaction` | Chrome click/type/fill/key/hover/drag/tap/scroll input |
+| `chrome-debugging` | Chrome page evaluation, console/network diagnostics, response retrieval, and file upload |
 | `mcp-management` | Shared MCP adapter management |
 
 Pinned tools are removed from these dynamic groups at runtime. For example, the default-pinned `codegraph_explore` and `lsp_diagnostics` do not consume the `code-intelligence` group budget.

pi-tool-search/docs/dynamic-tool-loading.md

@@ -15,6 +15,7 @@
 The standard bundle assigns the official Hippo Pi extension's five `hippo_*` tools to recall and management groups. `context_tree_query` remains in `memory-recall` because it recovers condensed tool output; retired Hermes names and third-party `tff-memory_*` names are not seeded.
 The maintained `pi-ssh` tools are also split by workflow: reviewed agent-controlled connection lives in `ssh-connection`, structured `ssh_read`/`ssh_write`/`ssh_edit` file operations live in `ssh-remote-files`, bounded `ssh_find`/`ssh_grep` discovery lives in `ssh-remote-search`, and the reviewed `ssh_bash` command surface stays isolated in `ssh-remote-shell`.
 The maintained `ask_user_question` tool has its own `user-interaction` group so the model can load the complete interactive schema only when a missing decision or preference must come from the user.
+The pinned `pi-chrome` bridge registers its 21 `chrome_*` tools only after explicit per-session authorization. Once registered, catalog refresh assigns them to `chrome-navigation`, `chrome-interaction`, and `chrome-debugging`; revocation still remains enforced inside every upstream tool execution even if a schema is later reactivated by Tool Search.
 
 A purely additive first load receives Pi's native dynamic-tool result propagation. A replacement that evicts one group while adding another is intentionally non-additive; current Pi detects the removal and uses its safe next-request fallback instead of attaching an invalid additive-only hint.
 

pi-tool-search/extensions/bundle-groups.ts

@@ -166,6 +166,33 @@ export const BUNDLE_GROUP_DEFINITIONS: BundleGroupDefinition[] = [
     keywords: ["ask", "question", "clarify", "choice", "preference", "提问", "澄清", "选择", "确认"],
     tools: ["ask_user_question"],
   },
+  {
+    id: "chrome-navigation",
+    title: "Chrome navigation and inspection",
+    summary: "Connect to the authorized Chrome bridge, manage tabs, navigate, inspect page structure, wait for state, and capture screenshots.",
+    useWhen: ["You need to inspect or navigate the user's existing signed-in Chrome profile after explicit /chrome authorization"],
+    avoidWhen: ["A normal web search or HTTP page fetch is sufficient, or Chrome has not been explicitly authorized"],
+    keywords: ["chrome", "browser", "tab", "navigate", "snapshot", "inspect", "screenshot", "浏览器", "标签页", "网页操作"],
+    tools: ["chrome_launch", "chrome_tab", "chrome_navigate", "chrome_snapshot", "chrome_find", "chrome_inspect", "chrome_wait_for", "chrome_screenshot"],
+  },
+  {
+    id: "chrome-interaction",
+    title: "Chrome page interaction",
+    summary: "Interact with an authorized Chrome page using real pointer, keyboard, touch, form, drag, and scroll input.",
+    useWhen: ["You must click, type, fill, press keys, hover, drag, tap, or scroll in the user's authorized Chrome session"],
+    avoidWhen: ["Page observation is enough, or the action is irreversible and the user has not approved it"],
+    keywords: ["chrome", "browser", "click", "type", "fill", "drag", "scroll", "点击", "输入", "滚动", "浏览器交互"],
+    tools: ["chrome_click", "chrome_type", "chrome_fill", "chrome_key", "chrome_hover", "chrome_drag", "chrome_tap", "chrome_scroll"],
+  },
+  {
+    id: "chrome-debugging",
+    title: "Chrome diagnostics and upload",
+    summary: "Evaluate page JavaScript, inspect captured console/network activity, retrieve response bodies, or attach local files.",
+    useWhen: ["Debugging the authorized Chrome page, examining fetch/XHR behavior, evaluating page state, or uploading an explicitly named local file"],
+    avoidWhen: ["Navigation, DOM inspection, or ordinary page interaction tools are sufficient"],
+    keywords: ["chrome", "browser", "console", "network", "javascript", "upload", "调试", "网络请求", "文件上传"],
+    tools: ["chrome_evaluate", "chrome_list_console_messages", "chrome_list_network_requests", "chrome_get_network_request", "chrome_upload_file"],
+  },
   {
     id: "mcp-management",
     title: "MCP management",

pi-tool-search/test/bundle-groups.test.ts

@@ -32,6 +32,9 @@ test("bundle seed names are unique and cover the declared my-pi tools", () => {
   assert.equal(result.catalog.tools.find((card) => card.name === "ssh_find")?.primaryGroup, "ssh-remote-search");
   assert.equal(result.catalog.tools.find((card) => card.name === "ssh_grep")?.primaryGroup, "ssh-remote-search");
   assert.equal(result.catalog.tools.find((card) => card.name === "ask_user_question")?.primaryGroup, "user-interaction");
+  assert.equal(result.catalog.tools.find((card) => card.name === "chrome_snapshot")?.primaryGroup, "chrome-navigation");
+  assert.equal(result.catalog.tools.find((card) => card.name === "chrome_click")?.primaryGroup, "chrome-interaction");
+  assert.equal(result.catalog.tools.find((card) => card.name === "chrome_list_network_requests")?.primaryGroup, "chrome-debugging");
 });
 
 test("user overrides take priority and unknown tools retain deterministic fallback groups", () => {

tests/extension-load.test.ts

@@ -40,6 +40,14 @@ test("all package extensions load together without global registration conflicts
 	assert.ok(packageJson.pi.extensions.includes("./pi-ask-user/index.ts"), "the bundle must load pi-ask-user");
 	assert.equal(packageJson.dependencies["pi-ask-user"], "file:./pi-ask-user");
 	assert.ok(packageJson.files.includes("pi-ask-user"), "the packed bundle must include pi-ask-user source");
+	const chromeExtension = "./node_modules/pi-chrome/extensions/chrome-profile-bridge/index.ts";
+	assert.equal(packageJson.dependencies["pi-chrome"], "0.15.46", "the browser bridge package must stay exactly pinned");
+	assert.ok(packageJson.pi.extensions.includes(chromeExtension), "the bundle must load pi-chrome's Chrome profile bridge");
+	assert.ok(
+		packageJson.pi.extensions.indexOf(chromeExtension) <
+			packageJson.pi.extensions.indexOf("./pi-tool-search/extensions/index.ts"),
+		"pi-chrome must register before Tool Search catalogs its authorized tools",
+	);
 	const permissionConfig = JSON.parse(
 		await readFile(join(repositoryRoot, "config", "pi-permission-system.json"), "utf8"),
 	) as { authorizerChain: string[]; permission: Record<string, unknown> };