Add opt-in CDP extension loading to configure

[rgarcia]

Summary

• add optional extension_load_strategy=restart|prefer_cdp to POST /configure
• preserve the existing restart path when the parameter is omitted, set to restart, or combined with a profile, nonempty policies, or nonempty Chromium flags
• add an explicit candidate-CDP execution mode that installs eligible unpacked extensions once, persists their startup flags, and activates them live
• transition enterprise-policy extensions and all CDP activation failures to one restart in the same request without replaying the multipart upload
• verify unpacked extensions after CDP-failure fallback while preserving existing display, navigation, locking, cleanup, and response behavior

Compatibility

The strategy is a query parameter rather than a multipart field. Older images ignore unknown query parameters, so requests to mixed fleets remain successful and use their legacy unconditional restart behavior. The regenerated Go client exposes the enum through ChromiumConfigureParams; invalid values receive a 400 from the strict service handler.

No diagnostic response fields or other response contract changes are included.

Review follow-up

• reuse the prepared enterprise extension batch after Chromium stops instead of extracting and validating the archives twice
• document why fallback verification retains configure's non-transactional persisted state rather than requiring a second recovery restart
• clarify that fallback still applies pending display changes
• cover prefer_cdp with an extension and display resize on both headless and headful images, asserting extension activation, changed resolution, stable WebSocket identity, and no restart

Testing

• deterministic OpenAPI regeneration
• go vet ./...
• go test -race $(go list ./... | grep -v '/e2e$') -count=1
• local headless and headful Chromium image builds
• go test -v -race -timeout 20m ./e2e -run '^TestChromiumConfigureExtensionLoadStrategies$' -count=1
  • headless and headful: default restart, live CDP activation, live CDP activation with display resize, startup-field restart, enterprise fallback, full CDP-failure fallback, and invalid strategy
  • headless: partial multi-extension activation failure followed by exactly one restart
• go test -v -race -timeout 15m ./e2e -run '^TestChromiumConfigureMultipartPowerset$' -count=1

---

Note

Medium Risk
Changes Chromium configure and extension activation paths (stop/start, CDP, persisted flags); default behavior is unchanged when the parameter is omitted, but fallback leaves partial state on failure by design.

Overview
Adds optional query parameter extension_load_strategy (restart | prefer_cdp) on POST /configure. Omitted or restart keeps today’s behavior: extensions still force a stop/start cycle when combined with profiles, nonempty policies, or flags.

With prefer_cdp, extension-only (plus display/start URL) requests prepare zips before taking the config lock, commit once, and try live CDP activation without restarting. Enterprise-policy extensions, nonempty flags/policies/profile, or CDP load failures trigger one in-request restart using the already-prepared batch (no second multipart parse). Restart path gains injectable extension install and post-restart verification hooks.

Extension helpers are refactored: commitPreparedExtensions no longer returns requiresRestart; installExtensionZipItems replaces the old apply helper. OpenAPI and the Go client pass ChromiumConfigureParams (including query serialization). Unit and e2e tests cover mode selection, invalid strategy, and restart vs live paths (including display resize without restart).

^{Reviewed by Cursor Bugbot for commit 8427e13. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: E2E uses external start URL
  • Replaced the external https://example.com start URL in the invalid-strategy subtest with an inline data: URL to keep the e2e input deterministic.

Or push these changes by commenting:

@cursor push 0ee956fb24

Preview (0ee956fb24)

diff --git a/server/e2e/e2e_chromium_configure_test.go b/server/e2e/e2e_chromium_configure_test.go
--- a/server/e2e/e2e_chromium_configure_test.go
+++ b/server/e2e/e2e_chromium_configure_test.go
@@ -250,7 +250,7 @@
 		invalid := instanceoapi.ChromiumConfigureParamsExtensionLoadStrategy("invalid")
 		response := chromiumConfigureE2E(t, ctx, client, configureE2ERequest{
 			params:   &instanceoapi.ChromiumConfigureParams{ExtensionLoadStrategy: &invalid},
-			startURL: "https://example.com",
+			startURL: "data:text/html,<title>kernel-configure-invalid-strategy</title>",
 		})
 		require.Equal(t, http.StatusBadRequest, response.StatusCode(), "%s", response.Body)
 	})

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Policy restart skips unpacked verification
  • In the prefer_cdp restart-required path, configure now verifies unpacked extensions after restart and surfaces a configure error when activation verification fails.

Or push these changes by commenting:

@cursor push 6756b5dd4a

Preview (6756b5dd4a)

diff --git a/server/cmd/api/api/chromium_configure.go b/server/cmd/api/api/chromium_configure.go
--- a/server/cmd/api/api/chromium_configure.go
+++ b/server/cmd/api/api/chromium_configure.go
@@ -188,7 +188,13 @@
 		return reqMsg, err
 	}
 	if prepared.requiresRestart {
-		return s.chromiumConfigureRestart(ctx, st, spec, commitExtensions)
+		if resp := s.chromiumConfigureRestart(ctx, st, spec, commitExtensions); resp != nil {
+			return resp
+		}
+		if err := s.verifyUnpackedExtensions(ctx, prepared.extensions); err != nil {
+			return cfg500ConfigureStep(chromiumConfigureStepExtensions, err.Error())
+		}
+		return nil
 	}
 
 	// Configure keeps the default restart path's non-transactional install semantics.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 7c7d312. Configure here.}