fix: remove flags blocking enterprise extension loading #133
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
rgarcia
force-pushed
the
fix/enterprise-extension-loading
branch
2 times, most recently
from
5f2d3eb to
6c33f9b
Compare
rgarcia
changed the title
rgarcia
force-pushed
the
fix/enterprise-extension-loading
branch
from
2545956 to
878c9f2
Compare
…nsion loading The default CHROMIUM_FLAGS included --disable-background-networking which prevented Chrome from fetching extensions via ExtensionInstallForcelist enterprise policy. Enterprise extensions require Chrome to make HTTP requests to fetch update.xml and .crx files from the local API server. Changes: - Remove --disable-background-networking from default CHROMIUM_FLAGS in headless image - Add e2e test for enterprise extension installation via policy (tests both headless and headful) The e2e test verifies that: 1. Extension is uploaded with update.xml and .crx files 2. Enterprise policy is correctly configured with ExtensionInstallForcelist 3. Chrome fetches the extension from the policy URL 4. Extension appears in chrome://extensions with correct ID
Rebuild with updated kernel CLI that preserves webRequestBlocking permission (valid for policy-installed MV3 extensions).
…tensions The --disable-extensions-except flag causes Chrome to set extensions_enabled_ to false, which prevents external providers (including the policy loader) from being created. This means Chrome never attempts to fetch force-installed extensions via ExtensionInstallForcelist enterprise policy. Changes: - Remove --disable-extensions-except from chromium.go flag generation - Remove --disable-extensions-except from wrapper.sh proxy extension setup - Update MergeExtensionPath to only use --load-extension - Update e2e test to upload kernel-like extension first (mirrors production) The fix allows enterprise policy extensions to be fetched and installed while still loading the kernel extension via --load-extension. See Chromium source: extension_service.cc - external providers are only created when extensions_enabled() returns true.
Replace the web-bot-auth-based test extension with a minimal extension that only has the webRequest permission needed to trigger enterprise policy installation. This makes the test more focused and reduces the extension size from 360KB to 1.3KB. Also fix runContainer to: - Add mode=1777 to tmpfs mount - Ensure CHROMIUM_FLAGS includes --no-sandbox for CI
rgarcia
force-pushed
the
fix/enterprise-extension-loading
branch
from
9197976 to
9f66c28
Compare
The --disable-extensions-except flag causes Chrome to set extensions_enabled() to false, which prevents ExtensionService from creating external providers (including the enterprise policy loader). This breaks ExtensionInstallForcelist policy-based extension installation. Changes: - MergeFlags() now parses --disable-extensions-except but does NOT re-emit it; instead, paths are merged into --load-extension - Updated tests to reflect new behavior
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
--disable-background-networkingfrom the defaultCHROMIUM_FLAGSin the headless wrapper--disable-extensions-exceptflag usage - this flag was preventing Chrome from creating external providers (including the policy loader), blocking enterprise extension installationExtensionInstallForcelistenterprise policy requires background networking to fetchupdate.xmland.crxfiles from the extension serverRoot Cause
Two issues were preventing enterprise extensions from loading:
--disable-background-networkingprevented Chrome from making HTTP requests to fetch extensions--disable-extensions-exceptcaused Chrome to setextensions_enabled_tofalse, which prevents external providers (including the policy loader) from being created inextension_service.ccChanges
Flag Changes
--disable-background-networkingfrom headless wrapper defaults--disable-extensions-exceptfrom:wrapper.shproxy extension setupchromium.goAPI flag generationchromiumflags.goMergeExtensionPath function--load-extensionfor loading extensions via command lineTest Changes
TestEnterpriseExtensionInstallatione2e testTest plan
TestEnterpriseExtensionInstallationNote
Allows enterprise policy (
ExtensionInstallForcelist) extensions to install correctly.--disable-background-networkingfrom headlesswrapper.shdefaults--disable-extensions-except;chromiumflags.MergeFlagsnow folds its paths into--load-extensionand never re-emits it; addsMergeExtensionPathserver/cmd/api/api/chromium.gono longer writes--disable-extensions-exceptwhen building flags; only uses--load-extensionfor non-policy extensions with clear inline rationaleTestEnterpriseExtensionInstallation(headless/headful) plus minimal enterprise test extension assets and pack script; verifies policy config, update.xml/.crx fetch, logs, and presence inchrome://extensionsWritten by Cursor Bugbot for commit 1472fd8. This will update automatically on new commits. Configure here.