why

• this allows users to specify a CDP url that the extension will use for its loopback/in-browser connection

what changed

• exposed extensionCdpUrl on localBrowser.connect()

test plan

• added unit tests ensuring the URL gets correctly propagated through the protocol

---

Summary by cubic

Adds an optional extensionCdpUrl param to localBrowser.connect() so callers can tell Stagehand's extension which CDP WebSocket to dial. Previously the extension always dialed the same URL the client connected with, which could hand gateway credentials to the browser and route extension traffic through the gateway.

When unset, behavior is unchanged. The value must be a ws:// or wss:// URL with a host and a port between 1 and 65535; invalid values are rejected with a validation error before any connection is attempted.