[feat:extensions] add support to package web-bot-auth

[archandatta]

Note

Adds a new CLI flow to fetch, build, and package Cloudflare’s web-bot-auth browser extension with Kernel-specific configs, plus supporting utils and tests.

• New kernel extensions build-web-bot-auth command in cmd/extensions.go with flags --to, --url, --key, --upload; can auto-upload to Kernel under a specified name
• Implements build pipeline in pkg/extensions/webbotauth.go: downloads GitHub archive, validates/converts Ed25519 keys (JWK/PEM), modifies policy/build templates, runs npm install/build/bundle, extracts extension ID, and copies artifacts (.crx, update.xml, policy, built files) to output
• Adds crypto helpers in pkg/util/crypto.go (ValidatePEMKey, IsPEMKey, ConvertJWKToPEM) and file ops in pkg/util/fileops.go (CopyFile, CopyDir, ModifyFile)
• New tests: download/extract integration in pkg/extensions/webbotauth_test.go and crypto unit tests in pkg/util/crypto_test.go

^{Written by Cursor Bugbot for commit 5268e7a. This will update automatically on new commits. Configure here.}

[rgarcia]

Good feature addition! The overall structure is clean and the UX is thoughtful with helpful next-steps messaging.

Main areas to address:

• JWK vs PEM messaging: Several places in help text, logs, and comments refer to "JWK" but PEM format is also supported. Would be good to make this consistent.
• Error handling: A few places where os.Stat errors other than IsNotExist are silently ignored, and some URL update failures are warnings instead of errors.
• Stability: Consider pinning the GitHub download to a specific commit to avoid upstream breaking changes.
• Crypto code: The stdlib already has crypto/x509.MarshalPKCS8PrivateKey for Ed25519 - no need to hand-roll ASN.1.

[rgarcia]

lgtm - nice work on the crypto refactor to use stdlib and good test coverage. just a few minor nits.