Register the durable extension resource

[IlyaasK]

Summary

• register the durable kernel_extension Terraform resource
• wire reviewed upload, read, delete, and import helpers through the Plugin Framework resource lifecycle
• require source_path and source_sha256 only when Terraform creates or replaces an extension
• add focused lifecycle and replacement-plan tests
• publish generated resource schema documentation

Why this v1 work

This activates the already-reviewed durable extension implementation as one complete Terraform resource. Kernel extensions are immutable through the current API, so name, project scope, and archive checksum changes replace the resource instead of using an update call.

Resource scope

The resource manages uploaded extension configuration only. It does not expose browser sessions, extension runtime state, downloads, logs, screenshots, live view, acquire/release, or implicit browser-pool mutation.

API contract notes

• create uses the SDK extension upload endpoint
• read uses the SDK extension metadata endpoint
• delete uses the SDK extension delete endpoint
• Kernel exposes no extension update operation, so all durable mutations require replacement
• delete remains non-forceful and reports browser-pool references as a conflict

Terraform state semantics

• state contains the canonical extension ID, remote name, resolved project scope, and server checksum
• source_path is write-only and never persisted in plan or state artifacts
• replacement planning requires the archive path and checksum before Terraform destroys the prior object
• import accepts <extension-id> or <project-id>/<extension-id>, seeds canonical identity and scope, then Read settles remote metadata

Sensitive fields

No secret is added. The local archive path is write-only; provider api_key sensitivity is unchanged.

Tests run

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go test -race ./internal/resources/extension ./internal/provider
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check HEAD^ HEAD

Acceptance status

Real-API Terraform acceptance has not run in this PR. Create, replacement, import, and delete remain an opt-in acceptance/release gate; focused unit, race, schema, docs, and local-provider example validation pass.

Deferred concerns

• end-to-end real-API acceptance coverage
• no runtime/session Terraform operations
• no implicit cleanup or force deletion
• no SDK or API changes

GitHub issue disposition

No existing issue is closed by this registration slice. Runtime operations and broader mutable extension API behavior remain outside this PR.

---

Note

Medium Risk
New resource lifecycle affects real Kernel extension uploads and deletes; immutability/replace behavior must be correct to avoid unintended replacements or failed deletes when pools reference extensions.

Overview
Registers kernel_extension on the Kernel Terraform provider so uploaded extensions can be managed as durable infrastructure (create, read, delete, import) via the existing client helpers.

The Plugin Framework resource treats extensions as immutable: Update is rejected, and changes to name, project_id, or source_sha256 are expected to replace the resource. ModifyPlan enforces source_path (write-only) and source_sha256 whenever Terraform creates or replaces an extension, but not on no-op plans or destroy.

Provider wiring adds the resource factory (and renames the extension data source import for clarity). Tests cover schema, configure, update rejection, and plan-time archive validation; generated docs/resources/extension.md documents the schema.

^{Reviewed by Cursor Bugbot for commit 073a4b8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Forced replace skips archive checks

Medium Severity

extensionReplacementPlanned only looks for diffs on name, project_id, and source_sha256, so a forced replace with unchanged attributes never sets requiresArchive. Plan can succeed without source_path / source_sha256 in config, then destroy runs and create fails afterward, which can delete the remote extension before upload is possible.

Additional Locations (1)

• internal/resources/extension/modify_plan.go#L23-L35

 

^{Reviewed by Cursor Bugbot for commit 77e6c31. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a741065. Configure here.}