Check trusted location before from_webstore in chromiumSideloaded

[juan-fdz-hawa]

Resolves #50706

chromiumSideloaded returned true as soon as from_webstore was 0, never reaching the trusted-location check. First-party browser components are installed by the browser itself and so always report from_webstore:false, which made the location exemption unreachable and flagged components like Edge Copilot Bridge as sideloaded_unverified.

Check location for Internal/Component first. The existing collector fixture asserted the buggy behaviour and is updated to a genuinely sideloaded location, with a first-party component case added.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

• Confirmed that the fix is not expected to adversely impact load test results

Summary by CodeRabbit

Bug Fixes

• Improved Chromium extension risk detection across Web Store and installation locations.
• Trusted internal and component extensions are no longer incorrectly flagged as sideloaded.
• Unknown, unpacked, and external extensions continue to be identified appropriately.
• Improved handling of first-party components with broad host permissions, while preserving relevant risk indicators.

[juan-fdz-hawa]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e5225ec-b553-4e53-990e-6047d30b40dd

📥 Commits

Reviewing files that changed from the base of the PR and between d2352ed and e287ab9.

📒 Files selected for processing (2)

• orbit/pkg/table/ai_tools/internal/browserext/browserext_test.go
• orbit/pkg/table/ai_tools/internal/browserext/risk.go

🚧 Files skipped from review as they are similar to previous changes (2)

• orbit/pkg/table/ai_tools/internal/browserext/risk.go
• orbit/pkg/table/ai_tools/internal/browserext/browserext_test.go

---

Walkthrough

The change updates Chromium extension classification so trusted internal and component locations are not marked as sideloaded, regardless of from_webstore. Tests add trusted and nontrusted location cases, extend the Chromium profile fixture with a first-party component, and verify that the component is recovered without the sideloaded_unverified risk flag.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary code change: checking trusted Chromium locations before from_webstore.
Description check	✅ Passed	The description identifies the issue, explains the fix, references the linked issue, and documents automated testing, QA, and load-test impact.
Linked Issues check	✅ Passed	The changes satisfy issue #50706 by prioritizing trusted locations, preserving untrusted-location detection, and adding regression tests.
Out of Scope Changes check	✅ Passed	The changes are limited to chromiumSideloaded logic and related regression tests required by issue #50706.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 50706-ai_tools-chromiumsideloaded-misclassifies-legitimate-browser-components

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.41%. Comparing base (12754cc) to head (e287ab9).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #50770   +/-   ##
=======================================
  Coverage   68.40%   68.41%           
=======================================
  Files        3963     3963           
  Lines      255174   255174           
  Branches    13616    13616           
=======================================
+ Hits       174555   174568   +13     
+ Misses      65020    65011    -9     
+ Partials    15599    15595    -4     

Flag	Coverage Δ
backend	69.61% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.