perf: load the browser-agent bridge lazily, only when MCP is enabled

The client-tool bridge only matters when the node exposes an MCP endpoint, so
gate it on `connectionMeta.mcp` (already forwarded in `__connection.json`) and
pull it in through a dynamic `import()`. Its code — the bridge, the browser
tool registry, and the client-id helper — now lands in its own chunk that a
non-MCP connection never downloads or runs.

Co-authored-by: agent <agent@opencode>

Author: antfubot

packages/devframe/src/client/rpc-auth-gate.test.ts

@@ -145,4 +145,29 @@ describe('getDevframeRpcClient: auth bootstrap gates outbound calls', () => {
     // `close?:` exists to keep working.
     expect(() => rpc.close?.()).not.toThrow()
   })
+
+  const INVOKE_CLIENT_TOOL = 'devframe:agent:invoke-client-tool'
+
+  it('loads the browser-agent bridge only when the node advertises MCP', async () => {
+    const { getDevframeRpcClient } = await import('./rpc')
+    const rpc = await getDevframeRpcClient({
+      connectionMeta: { ...connectionMeta, mcp: { path: '__mcp' } },
+      otpParam: false,
+      simpleAuth: false,
+    })
+    // The bridge lives in its own chunk and registers this handler once loaded.
+    await vi.waitFor(() => expect(rpc.client.definitions.has(INVOKE_CLIENT_TOOL)).toBe(true))
+  })
+
+  it('leaves the browser-agent bridge unloaded without MCP', async () => {
+    const { getDevframeRpcClient } = await import('./rpc')
+    const rpc = await getDevframeRpcClient({
+      connectionMeta,
+      otpParam: false,
+      simpleAuth: false,
+    })
+    // Give any stray dynamic import time to resolve; it must not.
+    await new Promise(resolve => setTimeout(resolve, 20))
+    expect(rpc.client.definitions.has(INVOKE_CLIENT_TOOL)).toBe(false)
+  })
 })

packages/devframe/src/client/rpc.ts

@@ -11,7 +11,6 @@ import { DEVFRAME_OTP_URL_PARAM } from 'devframe/constants'
 import { RpcCacheManager, RpcFunctionsCollectorBase } from 'devframe/rpc'
 import { createEventEmitter } from 'devframe/utils/events'
 import { withBase } from 'devframe/utils/url'
-import { setupBrowserAgentRpcBridge } from './browser-agent-rpc'
 import { setupDevframeConnection } from './connection'
 import { storeAuthToken } from './connection-storage'
 import { authenticateWithUrlOtp } from './otp'
@@ -358,6 +357,7 @@ export async function getDevframeRpcClient(
   // No-op when the browser provides no WebMCP model context.
   const disposeWebMcp = options.webmcp === false ? undefined : registerWebMcpTools(clientRpc)
   let disposeBrowserAgentBridge: (() => void) | undefined
+  let closed = false
 
   async function fetchJsonFromBases(path: string): Promise<any> {
     const candidates = [
@@ -449,6 +449,7 @@ export async function getDevframeRpcClient(
 
   /** Release authentication and transport resources even if another disposer fails. */
   function closeRpcClient(): void {
+    closed = true
     try {
       disposeBrowserAgentBridge?.()
       disposeWebMcp?.()
@@ -599,7 +600,17 @@ export async function getDevframeRpcClient(
     () => { bootstrapAuthSettled = true },
   )
 
-  disposeBrowserAgentBridge = setupBrowserAgentRpcBridge(rpc)
+  // Only when the node advertises an MCP endpoint (`connectionMeta.mcp`) is the
+  // browser-agent bridge useful, so load it from its own chunk on demand and
+  // keep it out of the main client bundle for every non-MCP connection.
+  if (connectionMeta.mcp) {
+    void import('./browser-agent-rpc')
+      .then(({ setupBrowserAgentRpcBridge }) => {
+        if (!closed)
+          disposeBrowserAgentBridge = setupBrowserAgentRpcBridge(rpc)
+      })
+      .catch(() => {})
+  }
 
   // Listen for auth updates from other tabs (e.g., the auth page, or another
   // tab that just completed a code exchange).