Mark page-world extension writes with EXTENSION source

The previous cleanup deleted every isExtensionCaller() site, including
the one in cookie/storage detectors that did fire reliably for the
residual case: page-world extensions (MV3 main world, userscripts with
@grant none) whose stack contains a chrome-/moz-/safari-web-extension
frame at the synchronous write. Recover that signal for free by
returning fromExtension from getInitiatorURL (it already walks the
stack and discards extension frames via continue), and have the cookie
and storage detectors report source: "extension" instead of "script"
when the flag is set.

End-to-end plumbing reuses the existing source column: extend the
cookie_source Postgres enum with EXTENSION, add the CookieSourceExtension
constant with a doc block describing each bucket's actual semantics,
add the handler.go switch cases, expose EXTENSION on the GraphQL and
MCP CookieSource enums, and add the Extension option to the console
source filter.

Update bestSource in the pattern analysis worker so a glob merging
only extension-attributed exact patterns is no longer silently rolled
up to PRE_EXISTING. New precedence is SCRIPT > EXTENSION > PRE_EXISTING,
matching the upsert SQL's "page-script wins" rule and the asymmetric
signal strength of each bucket.

Out of scope: any behavioural use of EXTENSION (auto-exclusion,
denylist classification, dashboard surfacing) -- that belongs in the
follow-up backend denylist plan.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/pattern_analysis_worker.go

@@ -633,11 +633,34 @@ func globMatch(pattern, name string) bool {
 	return true
 }
 
+// bestSource rolls up the source values of a group of exact patterns
+// being merged into a single glob. Precedence is SCRIPT > EXTENSION
+// > PRE_EXISTING, mirroring both the upsert SQL's "page-script wins"
+// rule and the asymmetric signal strength of each bucket: SCRIPT is
+// high-confidence page evidence (a real page tracker), EXTENSION is
+// high-confidence extension evidence, and PRE_EXISTING is the
+// catch-all that may include extension state injected before SDK
+// load. HTTP and nil collapse into PRE_EXISTING here, preserving
+// the original two-value rollup behaviour for non-script values.
 func bestSource(patterns []*coredata.TrackerPattern) *coredata.CookieSource {
+	var hasExtension bool
+
 	for _, p := range patterns {
-		if p.Source != nil && *p.Source == coredata.CookieSourceScript {
-			return p.Source
+		if p.Source == nil {
+			continue
 		}
+
+		switch *p.Source {
+		case coredata.CookieSourceScript:
+			return p.Source
+		case coredata.CookieSourceExtension:
+			hasExtension = true
+		}
+	}
+
+	if hasExtension {
+		src := coredata.CookieSourceExtension
+		return &src
 	}
 
 	src := coredata.CookieSourcePreExisting

pkg/coredata/cookie_source.go

@@ -21,10 +21,43 @@ import (
 
 type CookieSource string
 
+// CookieSourceScript: JS write observed via a detector hook on the
+// page realm's prototypes. In practice this is a page-script write
+// with high confidence -- isolated-world content scripts use their
+// own realm's prototypes and never trip the hook (they don't land
+// in this bucket at all), and page-world extensions (MV3 main world,
+// userscripts with @grant none) reliably leave a browser-extension
+// frame on the stack and classify as CookieSourceExtension. The
+// only residual contamination is rare cases where a page-world
+// extension's frame gets stripped from the stack (deep async,
+// page-side trampolines).
+//
+// CookieSourceExtension: synchronous JS write whose stack at the
+// hook contained at least one chrome-/moz-/safari-web-extension
+// frame. A page-world extension write is confirmed.
+//
+// CookieSourcePreExisting: enumerated from the storage at SDK init
+// rather than observed at write time. This is the catch-all bucket:
+// it bundles real pre-existing cookies/storage from prior sessions,
+// HTTP-set cookies that landed before our SDK ran, and -- crucially
+// -- writes from any extension realm (including isolated-world
+// content scripts) that happened before SDK init. Many extensions
+// inject at document_start specifically to set state before page
+// scripts run, so a meaningful share of PRE_EXISTING rows can be
+// extension-origin even though we cannot prove it. Treat this value
+// as low-signal for "is this a real page tracker" decisions.
+//
+// CookieSourceHTTP: cookie change observed via the CookieStore API
+// change event. Set by the server (Set-Cookie response header).
+//
+// Rows persisted before CookieSourceExtension was introduced cannot
+// be backfilled -- the stack at write time is gone -- so historic
+// SCRIPT rows retain the (mild) ambiguity above for that period.
 const (
 	CookieSourceScript      CookieSource = "SCRIPT"
 	CookieSourcePreExisting CookieSource = "PRE_EXISTING"
 	CookieSourceHTTP        CookieSource = "HTTP"
+	CookieSourceExtension   CookieSource = "EXTENSION"
 )
 
 var (
@@ -38,6 +71,7 @@ func CookieSources() []CookieSource {
 		CookieSourceScript,
 		CookieSourcePreExisting,
 		CookieSourceHTTP,
+		CookieSourceExtension,
 	}
 }
 
@@ -46,7 +80,8 @@ func (v CookieSource) IsValid() bool {
 	case
 		CookieSourceScript,
 		CookieSourcePreExisting,
-		CookieSourceHTTP:
+		CookieSourceHTTP,
+		CookieSourceExtension:
 		return true
 	}
 

pkg/coredata/migrations/20260522T155558Z.sql

@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE cookie_source ADD VALUE IF NOT EXISTS 'EXTENSION';

pkg/server/api/console/v1/graphql/cookie_banner.graphql

@@ -32,6 +32,10 @@ enum CookieSource
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.CookieSourcePreExisting"
         )
+    EXTENSION
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CookieSourceExtension"
+        )
 }
 
 enum TrackerType

pkg/server/api/cookiebanner/v1/handler.go

@@ -439,6 +439,8 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 			source = coredata.CookieSourcePreExisting
 		case "http":
 			source = coredata.CookieSourceHTTP
+		case "extension":
+			source = coredata.CookieSourceExtension
 		default:
 			source = coredata.CookieSourceScript
 		}
@@ -480,6 +482,8 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 		switch strings.TrimSpace(s.Source) {
 		case "pre-existing":
 			source = coredata.CookieSourcePreExisting
+		case "extension":
+			source = coredata.CookieSourceExtension
 		default:
 			source = coredata.CookieSourceScript
 		}

pkg/server/api/mcp/v1/specification.yaml

@@ -9470,7 +9470,7 @@ components:
           description: Pattern description
         source:
           type: string
-          enum: [SCRIPT, PRE_EXISTING]
+          enum: [SCRIPT, PRE_EXISTING, EXTENSION]
           description: How the pattern was discovered
         excluded:
           type: boolean