wrapper: parallel phase A boot, per-probe durations, split into feature files

Start chromium alongside xorg/xvfb so chromium-launcher's preamble overlaps
display startup; chromium-launcher waits internally for the X server.
Final ready log reports per-probe (cdp/chromedriver/forward-proxy/...)
durations so the gating probe is visible. main.go split into feature files
(supervisord, probes, display, chromium, envoy, system).

Author: sjmiller609

server/cmd/chromium-launcher/main.go

@@ -42,6 +42,11 @@ func main() {
 	// Wait for devtools port to be available (handles SIGKILL socket cleanup delay)
 	waitForPort(internalPort, 5*time.Second)
 
+	// Wait for the X server. The wrapper starts chromium in parallel with
+	// xorg/xvfb, so the display socket may not be ready yet — without this
+	// gate chromium would fail on connect and supervisord would restart us.
+	waitForX(":1", 20*time.Second)
+
 	baseFlags := os.Getenv("CHROMIUM_FLAGS")
 	runtimeTokens, err := chromiumflags.ReadOptionalFlagFile(*runtimeFlagsPath)
 	if err != nil {
@@ -125,6 +130,30 @@ func execLookPath(file string) (string, error) {
 	return exec.LookPath(file)
 }
 
+// waitForX blocks until the X server is reachable on display :N. We try
+// both the named unix socket (Xorg, headful) and the abstract namespace
+// socket (Xvfb runs with -nolisten unix, which disables the named socket
+// but leaves the abstract one). Mirrors the wrapper's check so chromium
+// can be started in parallel with the X server without failing on connect.
+func waitForX(display string, timeout time.Duration) {
+	num := strings.TrimPrefix(display, ":")
+	named := "/tmp/.X11-unix/X" + num
+	abstract := "@/tmp/.X11-unix/X" + num
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if c, err := net.DialTimeout("unix", named, 200*time.Millisecond); err == nil {
+			_ = c.Close()
+			return
+		}
+		if c, err := net.DialTimeout("unix", abstract, 200*time.Millisecond); err == nil {
+			_ = c.Close()
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	fmt.Fprintf(os.Stderr, "warning: X display %s not responsive after %s\n", display, timeout)
+}
+
 // waitForPort waits until the given port is available for binding on IPv4.
 // This handles the delay after SIGKILL before the kernel releases the socket.
 // We disable SO_REUSEADDR to get an accurate check matching chromium's bind behavior.

server/cmd/wrapper/chromium.go

@@ -0,0 +1,121 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// applyHeadlessDefaultFlags mirrors the legacy headless wrapper.sh: when
+// CHROMIUM_FLAGS is unset, fill in a curated headless+stealth flag list.
+// --disable-background-networking is intentionally omitted: it prevents
+// Chrome from fetching ExtensionInstallForcelist managed extensions.
+func applyHeadlessDefaultFlags() {
+	if strings.TrimSpace(os.Getenv("CHROMIUM_FLAGS")) != "" {
+		return
+	}
+	flags := strings.Join([]string{
+		"--accept-lang=en-US,en",
+		"--allow-pre-commit-input",
+		"--blink-settings=primaryHoverType=2,availableHoverTypes=2,primaryPointerType=4,availablePointerTypes=4",
+		"--crash-dumps-dir=/tmp/chromium-dumps",
+		"--disable-back-forward-cache",
+		"--disable-background-timer-throttling",
+		"--disable-backgrounding-occluded-windows",
+		"--disable-blink-features=AutomationControlled",
+		"--disable-breakpad",
+		"--disable-client-side-phishing-detection",
+		"--disable-component-extensions-with-background-pages",
+		"--disable-crash-reporter",
+		"--disable-crashpad",
+		"--disable-dev-shm-usage",
+		"--disable-features=AcceptCHFrame,AutoExpandDetailsElement,AvoidUnnecessaryBeforeUnloadCheckSync,CertificateTransparencyComponentUpdater,DeferRendererTasksAfterInput,DestroyProfileOnBrowserClose,DialMediaRouteProvider,ExtensionManifestV2Disabled,GlobalMediaControls,HttpsUpgrades,ImprovedCookieControls,LazyFrameLoading,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate",
+		"--disable-field-trial-config",
+		"--disable-gcm-registration",
+		"--disable-gpu",
+		"--disable-gpu-compositing",
+		"--disable-hang-monitor",
+		"--disable-ipc-flooding-protection",
+		"--disable-notifications",
+		"--disable-popup-blocking",
+		"--disable-prompt-on-repost",
+		"--disable-renderer-backgrounding",
+		"--disable-search-engine-choice-screen",
+		"--disable-software-rasterizer",
+		"--enable-use-zoom-for-dsf=false",
+		"--export-tagged-pdf",
+		"--force-color-profile=srgb",
+		"--hide-crash-restore-bubble",
+		"--hide-scrollbars",
+		"--metrics-recording-only",
+		"--mute-audio",
+		"--no-default-browser-check",
+		"--no-first-run",
+		"--no-sandbox",
+		"--no-service-autorun",
+		"--ozone-platform=headless",
+		"--password-store=basic",
+		"--unsafely-disable-devtools-self-xss-warnings",
+		"--use-angle=swiftshader",
+		"--use-gl=angle",
+		"--use-mock-keychain",
+	}, " ")
+	_ = os.Setenv("CHROMIUM_FLAGS", flags)
+}
+
+// dismissNoSandboxWarning replicates the wrapper.sh behaviour of clicking the
+// "X" on the --no-sandbox infobar. Cosmetic; runs off the hot path.
+func dismissNoSandboxWarning() {
+	out, err := exec.Command("xdotool", "getdisplaygeometry").Output()
+	if err != nil {
+		return
+	}
+	parts := strings.Fields(strings.TrimSpace(string(out)))
+	if len(parts) != 2 {
+		return
+	}
+	width := parts[0]
+	x := width
+	if w := atoi(width); w > 30 {
+		x = fmt.Sprintf("%d", w-30)
+	}
+	target := "New Tab - Chromium"
+	deadline := time.Now().Add(30 * time.Second)
+	for time.Now().Before(deadline) {
+		out, err := exec.Command("xdotool", "search", "--name", target).Output()
+		if err == nil && len(strings.TrimSpace(string(out))) > 0 {
+			id := strings.Fields(string(out))[0]
+			if exec.Command("xdotool", "windowactivate", "--sync", id).Run() == nil {
+				break
+			}
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	// Without a settle delay the click can land before the --no-sandbox infobar
+	// has finished painting, leaving the warning on screen. The legacy
+	// wrapper.sh slept 5s here for the same reason. Runs off the hot path
+	// (goroutine fired post-readiness) so this doesn't extend time-to-CDP.
+	time.Sleep(5 * time.Second)
+	port := os.Getenv("KERNEL_IMAGES_API_PORT")
+	if port == "" {
+		port = defaultAPIPort
+	}
+	body := fmt.Sprintf(`{"x":%s,"y":115}`, x)
+	_ = exec.Command("curl", "-s", "-o", "/dev/null", "-X", "POST",
+		"http://localhost:"+port+"/computer/click_mouse",
+		"-H", "Content-Type: application/json",
+		"-d", body).Run()
+}
+
+func atoi(s string) int {
+	n := 0
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return 0
+		}
+		n = n*10 + int(c-'0')
+	}
+	return n
+}

server/cmd/wrapper/display.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"net"
+	"strings"
+	"time"
+)
+
+// waitForX waits until the X server is reachable on display :N. We try both
+// the named unix socket (Xorg, headful) and the abstract namespace socket
+// (Xvfb runs with -nolisten unix, which disables the named socket but leaves
+// the abstract one). Cheaper than spawning xdpyinfo in a loop.
+func waitForX(display string, timeout time.Duration) {
+	num := strings.TrimPrefix(display, ":")
+	named := "/tmp/.X11-unix/X" + num
+	abstract := "@/tmp/.X11-unix/X" + num // Linux abstract namespace
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if c, err := net.DialTimeout("unix", named, 200*time.Millisecond); err == nil {
+			_ = c.Close()
+			return
+		}
+		if c, err := net.DialTimeout("unix", abstract, 200*time.Millisecond); err == nil {
+			_ = c.Close()
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	logf("WARNING: X display %s not responsive after %s", display, timeout)
+}

server/cmd/wrapper/envoy.go

@@ -0,0 +1,13 @@
+package main
+
+import "os"
+
+// envoyEnabled mirrors init-envoy.sh's gate: when any of these are unset
+// the script exits early without starting envoy, so we should skip the
+// readiness probe too (otherwise it would just time out at 60s).
+func envoyEnabled() bool {
+	return os.Getenv("INST_NAME") != "" &&
+		os.Getenv("METRO_NAME") != "" &&
+		os.Getenv("XDS_SERVER") != "" &&
+		os.Getenv("KERNEL_INSTANCE_JWT") != ""
+}