playwright-e2e-mcp 0.6.1 → 0.8.0

package/dist/utils/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/utils/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAYvD,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAElD,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,eAAe,EAAE;YAC7E,IAAI,EAAE,4GAA4G;SACnH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,4CAA4C,GAAG,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE;YACpG,IAAI,EAAE,+FAA+F;SACtG,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,eAAe,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;IACrH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,YAAY,CAAC,QAAsB,EAAE,IAAI,GAAW,IAAI,CAAC,GAAG,EAAE;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,aAAa,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACjG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxG,OAAO,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,eAAe,CAAC,QAAsB,EAAE,IAAI,GAAW,IAAI,CAAC,GAAG,EAAE;IAC/E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC"}

package/dist/utils/update-check.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Asks the npm registry for the latest published version of this package and
+ * compares it with the running one. Used by `doctor`, which a person runs on
+ * purpose; the MCP server itself never calls this.
+ *
+ * The request carries nothing but the package name (no project data, no
+ * identifiers). It is skipped when PW_MCP_NO_UPDATE_CHECK=1 or when called
+ * with `offline`, and any failure (no network, a proxy, a slow registry)
+ * resolves to `unknown` instead of throwing.
+ */
+export declare const PACKAGE_NAME = "playwright-e2e-mcp";
+export declare const REGISTRY_LATEST_URL = "https://registry.npmjs.org/playwright-e2e-mcp/latest";
+export type UpdateStatus = {
+    state: 'current';
+    current: string;
+    latest: string;
+} | {
+    state: 'outdated';
+    current: string;
+    latest: string;
+} | {
+    state: 'ahead';
+    current: string;
+    latest: string;
+} | {
+    state: 'unknown';
+    current: string;
+    reason: string;
+} | {
+    state: 'skipped';
+    current: string;
+    reason: string;
+};
+/** Compares two x.y.z versions (a pre-release sorts before its release). */
+export declare function compareVersions(a: string, b: string): number;
+export interface UpdateCheckOptions {
+    offline?: boolean;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function checkForUpdate(current: string, options?: UpdateCheckOptions): Promise<UpdateStatus>;
+/**
+ * How to upgrade, by the way this copy was installed. `npx -y
+ * playwright-e2e-mcp` (npm 10, which ships with Node 22) checks the registry
+ * on every launch and picks up a new release by itself, so restarting the MCP
+ * client is enough there; a project or global install, a git clone or the
+ * Docker image stays on its version until updated.
+ */
+export declare const UPGRADE_HINT: string;

package/dist/utils/update-check.js

@@ -0,0 +1,75 @@
+/**
+ * Asks the npm registry for the latest published version of this package and
+ * compares it with the running one. Used by `doctor`, which a person runs on
+ * purpose; the MCP server itself never calls this.
+ *
+ * The request carries nothing but the package name (no project data, no
+ * identifiers). It is skipped when PW_MCP_NO_UPDATE_CHECK=1 or when called
+ * with `offline`, and any failure (no network, a proxy, a slow registry)
+ * resolves to `unknown` instead of throwing.
+ */
+export const PACKAGE_NAME = 'playwright-e2e-mcp';
+export const REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
+/** Compares two x.y.z versions (a pre-release sorts before its release). */
+export function compareVersions(a, b) {
+    const parse = (v) => {
+        const [core = '', pre = ''] = v.trim().replace(/^v/, '').split('-', 2);
+        const nums = core.split('.').map((n) => Number.parseInt(n, 10) || 0);
+        while (nums.length < 3)
+            nums.push(0);
+        return { nums, pre };
+    };
+    const x = parse(a);
+    const y = parse(b);
+    for (let i = 0; i < 3; i++) {
+        if (x.nums[i] !== y.nums[i])
+            return x.nums[i] < y.nums[i] ? -1 : 1;
+    }
+    if (x.pre === y.pre)
+        return 0;
+    if (!x.pre)
+        return 1;
+    if (!y.pre)
+        return -1;
+    return x.pre < y.pre ? -1 : 1;
+}
+export async function checkForUpdate(current, options = {}) {
+    const env = options.env ?? process.env;
+    if (options.offline)
+        return { state: 'skipped', current, reason: '--offline' };
+    if (env.PW_MCP_NO_UPDATE_CHECK === '1' || env.PW_MCP_NO_UPDATE_CHECK === 'true') {
+        return { state: 'skipped', current, reason: 'PW_MCP_NO_UPDATE_CHECK is set' };
+    }
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function')
+        return { state: 'unknown', current, reason: 'fetch is not available' };
+    try {
+        const res = await fetchImpl(REGISTRY_LATEST_URL, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(options.timeoutMs ?? 3000),
+        });
+        if (!res.ok)
+            return { state: 'unknown', current, reason: `npm registry answered ${res.status}` };
+        const body = (await res.json());
+        const latest = typeof body.version === 'string' ? body.version : '';
+        if (!/^\d+\.\d+\.\d+/.test(latest))
+            return { state: 'unknown', current, reason: 'npm registry gave no version' };
+        const cmp = compareVersions(current, latest);
+        return { state: cmp < 0 ? 'outdated' : cmp > 0 ? 'ahead' : 'current', current, latest };
+    }
+    catch (err) {
+        const message = err.name === 'TimeoutError' ? 'npm registry did not answer in time' : err.message.split('\n')[0];
+        return { state: 'unknown', current, reason: message };
+    }
+}
+/**
+ * How to upgrade, by the way this copy was installed. `npx -y
+ * playwright-e2e-mcp` (npm 10, which ships with Node 22) checks the registry
+ * on every launch and picks up a new release by itself, so restarting the MCP
+ * client is enough there; a project or global install, a git clone or the
+ * Docker image stays on its version until updated.
+ */
+export const UPGRADE_HINT = 'restart your MCP client (npx -y playwright-e2e-mcp fetches the new version itself); ' +
+    'project install: npm install -D playwright-e2e-mcp@latest · global: npm install -g playwright-e2e-mcp@latest · ' +
+    'Docker: docker pull ghcr.io/xsignon-secure/playwright-e2e-mcp:latest · git clone: git pull && npm ci';
+//# sourceMappingURL=update-check.js.map

package/dist/utils/update-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../../src/utils/update-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,8BAA8B,YAAY,SAAS,CAAC;AASvF,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;QAC1B,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,OAAO,GAAuB,EAAE;IACpF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/E,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG,IAAI,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAAE,CAAC;QAChF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC5G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE;YAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,yBAAyB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACjH,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,GAAa,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvI,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GACvB,sFAAsF;IACtF,iHAAiH;IACjH,sGAAsG,CAAC"}

package/examples/github-actions/playwright-e2e.yml

@@ -0,0 +1,80 @@
+name: Playwright E2E Diagnosis
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+# Permissions required:
+# - contents: read to check out the repository
+# - pull-requests: write to post/update the PR comment report and suggested fixes
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  e2e:
+    name: Playwright E2E Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright browsers and OS dependencies
+        run: npx playwright install --with-deps chromium
+
+      - name: Run Playwright E2E diagnosis action
+        id: e2e
+        uses: xsignon-secure/E2E@v0.8.0
+        with:
+          # Directory containing playwright.config.* (default is workspace root)
+          project-root: .
+
+          # Extra arguments passed to playwright-e2e-mcp ci, e.g. "--browser chromium tests/checkout"
+          # args: --browser chromium tests/
+
+          # Repeat failing tests (2-10) to obtain an empirical flaky verdict; 0 skips
+          flaky-runs: 3
+
+          # Draft suggest-fix diffs for the first N failures (0-5)
+          suggest: 2
+
+          # Re-run each failing test with its fix applied and post only verified fixes
+          verify-fixes: true
+
+          # Post verified fixes directly as one-click GitHub suggested changes on the PR
+          review: true
+
+          # Post/edit a single diagnosis summary comment on the PR
+          comment: true
+
+          # Heal guard: block test changes that pass by checking less (deleted assertions, skipped tests, .only)
+          # guard: true
+
+          # Pro Cloud integration (optional, paid): upload run history to Pro Cloud
+          # pro-key: ${{ secrets.PW_MCP_PRO_KEY }}
+          # pro-url: https://pro.example.com
+
+          # Fail step when tests fail (default: true)
+          fail-on-failure: true
+
+      - name: Upload diagnosis report
+        if: always() && steps.e2e.outputs.report != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-e2e-diagnosis-report
+          path: ${{ steps.e2e.outputs.report }}
+          retention-days: 14

package/examples/gitlab-ci/playwright-e2e.yml

@@ -0,0 +1,71 @@
+# playwright-e2e-mcp on GitLab CI.
+#
+# Copy this into .gitlab-ci.yml (or `include:` it). It does what the GitHub
+# Action does, with GitLab's own pieces:
+#   - on a merge request, the heal guard fails the job when a changed test
+#     now checks less (an assertion removed, a test skipped, `.only` added);
+#   - `ci` runs the suite (auto-retry once, so flaky tests are reported as
+#     flaky), repeats failures for a flaky verdict and drafts fixes;
+#   - the Markdown report is printed in the job log, kept as an artifact
+#     and, when E2E_REPORT_TOKEN is set, posted as a merge request comment.
+#
+# Exit codes of `ci`: 0 passed (flaky allowed), 1 tests failed, 2 the run
+# itself failed (no Playwright, config error, timeout).
+
+stages:
+  - test
+
+playwright-e2e:
+  stage: test
+  # Microsoft's Playwright image ships Node and the browsers. Use the tag that
+  # matches the @playwright/test version in your package-lock.json (the
+  # browsers are tied to it), e.g. v1.64.1-noble for 1.64.1.
+  image: mcr.microsoft.com/playwright:v1.64.1-noble
+  variables:
+    # The guard compares with the target branch, so it needs real history.
+    GIT_DEPTH: "0"
+    npm_config_cache: "$CI_PROJECT_DIR/.npm"
+  cache:
+    key:
+      files:
+        - package-lock.json
+    paths:
+      - .npm/
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  before_script:
+    - npm ci --prefer-offline
+  script:
+    # 1. Heal guard, merge requests only. Add --strict to fail on warnings too.
+    - |
+      if [ -n "$CI_MERGE_REQUEST_IID" ]; then
+        git fetch --quiet origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
+        npx -y playwright-e2e-mcp guard --base "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
+      fi
+    # 2. Run and diagnose the suite. --verify-fixes re-runs each failing test
+    #    with its drafted fix applied, then restores the file.
+    - npx -y playwright-e2e-mcp ci --flaky-runs 3 --suggest 2 --verify-fixes --output e2e-report.md
+  after_script:
+    # 3. Post the report on the merge request. E2E_REPORT_TOKEN is a project
+    #    access token with the `api` scope, stored as a masked CI/CD variable.
+    #    after_script runs even when the tests fail, so the report still lands.
+    - |
+      if [ -f e2e-report.md ] && [ -n "$CI_MERGE_REQUEST_IID" ] && [ -n "$E2E_REPORT_TOKEN" ]; then
+        node -e 'process.stdout.write(JSON.stringify({ body: require("fs").readFileSync("e2e-report.md", "utf8").slice(0, 900000) }))' > e2e-note.json
+        curl --silent --show-error --fail --request POST \
+          --header "PRIVATE-TOKEN: $E2E_REPORT_TOKEN" \
+          --header "Content-Type: application/json" \
+          --data @e2e-note.json \
+          "$CI_API_V4_URL/projects/$CI_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes" > /dev/null \
+          || echo "Could not post the report on the merge request"
+      fi
+  artifacts:
+    name: "playwright-e2e-$CI_COMMIT_REF_SLUG"
+    when: always
+    expose_as: "Playwright E2E report"
+    paths:
+      - e2e-report.md
+      - playwright-report/
+      - test-results/
+    expire_in: 14 days

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "playwright-e2e-mcp",
-  "version": "0.6.1",
-  "description": "MCP server and agent skill that run, diagnose and fix failing Playwright tests: CI report diagnosis, trace analysis, verified locator fixes, flaky verdicts, breaking commits, tests written by walking the flow, accessibility and Web Vitals audits.",
+  "version": "0.8.0",
+  "description": "MCP server and agent skill that run, diagnose and fix failing Playwright tests (TypeScript and pytest): CI report diagnosis, trace analysis, verified locator fixes, flaky verdicts, breaking commits, heal guard, accessibility and Web Vitals audits.",
   "author": "xsignon-secure (https://github.com/xsignon-secure)",
   "mcpName": "io.github.xsignon-secure/E2E",
   "type": "module",

package/skill/playwright-e2e-mcp/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: playwright-e2e-mcp
-description: Runs, debugs and fixes Playwright end-to-end tests through the playwright-e2e-mcp server, using structured run results grouped by root cause, trace-based failure diagnostics, verified locators, self-healing fixes that re-run and revert if still red, per-test flaky verdicts that separate parallelism, test-order and timing bugs, signed-in page inspection with network mocks and HAR replay, aria snapshots, tests written by walking the flow on the live page, CI report diagnosis, WCAG accessibility audits, Web Vitals performance audits and local run history with the commit that broke each test, plus a guide to writing tests that stay green. Use when the user asks to run Playwright tests, fix a failing or broken e2e test, find out why a CI run failed, find out why a test is flaky or which tests are unstable or slow, repair a selector that no longer matches, write or review a Playwright test, check a page for accessibility, performance or visual regressions.
+description: "Runs, debugs and fixes Playwright end-to-end tests through the playwright-e2e-mcp server: run results grouped by root cause, trace-based failure diagnostics, verified locators, self-healing fixes that re-run and revert if still red, a heal guard that blocks fixes which pass by checking less, per-test flaky verdicts (parallelism, test order, timing), an owned, expiring flaky-test quarantine, saved logins with 2FA codes, signed-in page inspection with network mocks, tests written by walking the flow, CI report diagnosis, accessibility and Web Vitals audits and run history with the commit that broke each test. Use when the user asks to run Playwright tests, fix a failing or broken e2e test, find out why CI failed, find flaky, unstable or slow tests, repair a selector, write or review a Playwright test, log in for tests, or check a page for accessibility, performance or visual regressions."
 ---
 
 # Playwright E2E with playwright-e2e-mcp
@@ -13,7 +13,7 @@ and concrete next steps. It can also propose and apply a verified fix for a brok
 locator, inspect pages behind a login, run long suites in the background and keep
 a local history of every run.
 
-This skill is written for playwright-e2e-mcp 0.6.1 and works with 0.2.0 or
+This skill is written for playwright-e2e-mcp 0.8.0 and works with 0.2.0 or
 newer. If `suggest-fix`, `get-run-status` or `analyze-history` is missing, the
 server is older than 0.2.0: use the steps that do not need those tools and tell
 the user to update it. `diagnose-flaky`'s per-test table and `isolate` option
@@ -21,7 +21,12 @@ arrived in 0.3.0; `audit-accessibility`, `diagnose-flaky`'s `order` option and
 root-cause grouping in `run-test` arrived in 0.4.0; `audit-performance`,
 `load-report`, network mocks (`routes`), `har`, `browser`, `inspect-page`'s
 `view: "aria"`, `generate-e2e-test`'s `steps`, the `slow`, `trend` and `commits`
-history views and strict-mode fixes in `suggest-fix` arrived in 0.5.0.
+history views and strict-mode fixes in `suggest-fix` arrived in 0.5.0;
+`save-login`, `check-test-change` and `quarantine` arrived in 0.7.0; the
+`switchTab` page step, `blockWrites`, recovery of crashed runs and
+pytest-playwright projects (`run-test`, `get-failure`, `list-tests`) arrived in
+0.8.0. If `doctor` says a newer version is out, pass its upgrade command on to
+the user.
 
 ## Before you start
 
@@ -29,8 +34,8 @@ history views and strict-mode fixes in `suggest-fix` arrived in 0.5.0.
    `get-run-status`, `get-failure`, `load-report`, `suggest-fix`, `inspect-page`,
    `validate-selector`, `list-tests`, `generate-e2e-test`,
    `compare-visual-state`, `audit-accessibility`, `audit-performance`,
-   `diagnose-flaky` and
-   `analyze-history` (your client
+   `diagnose-flaky`, `analyze-history`, `audit-tests`, `bisect-failure`,
+   `save-login`, `check-test-change` and `quarantine` (your client
    may prefix them, e.g. `mcp__playwright-e2e__run-test`).
 2. If they are all missing, stop and tell the user the MCP server is not
    connected. Point them to `references/setup.md` for the one-line install for
@@ -39,7 +44,7 @@ history views and strict-mode fixes in `suggest-fix` arrived in 0.5.0.
    `references/writing-tests.md`. Do not fall back to shelling out to `npx playwright test` unless
    the user asks. If only some are missing, the server may run a smaller tool
    profile (`--tools=core` exposes `run-test`, `get-run-status`, `get-failure`,
-   `suggest-fix`, `diagnose-flaky` and `list-tests`); work with what is there and
+   `suggest-fix`, `diagnose-flaky`, `check-test-change` and `list-tests`); work with what is there and
    mention the profile when a task needs a page tool.
 3. Every tool except `get-run-status` takes an optional `projectRoot`. Leave it
    out unless the user works in a sub-project; the server defaults to `PW_MCP_PROJECT_ROOT` or its working
@@ -88,6 +93,10 @@ Follow these steps in order. Do not edit code before step 3.
    - Failed network request (4xx/5xx/no response) right before the failure: the
      backend is the likely cause; report it.
 4. **Fix** the spec or the app code, the smallest change that addresses the cause.
+   Then call `check-test-change` (0.7.0+; no arguments checks the uncommitted
+   changes). If it says **BLOCK**, the fix made the test pass by checking less
+   (a deleted assertion, a skip, `.only`): undo that part and fix the cause. Treat
+   **WARN** findings as things to justify to the user, not to wave through.
 5. **Re-run only what failed:** `run-test` with `{ "lastFailed": true }`. Repeat
    from step 2 until green.
 
@@ -136,6 +145,26 @@ fresh browser, so a signed-in page shows the login screen unless you pass state:
   (it must be installed; `audit-performance` stays Chromium-only).
 - `viewport`: `{ "width": 390, "height": 844 }` for mobile layouts.
 
+When there is no saved session yet, or it expired, call `save-login` (0.7.0+)
+instead of typing credentials into `actions` every time:
+
+```json
+{ "url": "http://localhost:3000/login",
+  "actions": [
+    { "type": "fill", "locator": "getByLabel('Email')", "value": "qa@example.com" },
+    { "type": "fill", "locator": "getByLabel('Password')", "value": "{{env:E2E_PASSWORD}}" },
+    { "type": "fill", "locator": "getByLabel('Code')", "value": "{{totp}}" },
+    { "type": "click", "locator": "getByRole('button', { name: 'Sign in' })" }],
+  "verify": { "url": "/account", "visible": "getByRole('button', { name: 'Sign out' })", "notUrl": "/login" },
+  "totpSecretEnv": "E2E_TOTP_SECRET" }
+```
+
+It saves `playwright/.auth/user.json` and reuses it while `verify` passes. Never
+put a password in a tool argument or in chat: ask the user to set it as an
+environment variable for the server (`E2E_*`, `TEST_*`, `LOGIN_*`, or a name
+listed in `PW_MCP_LOGIN_ENV`) and refer to it as `{{env:NAME}}`. `{{totp}}`
+types the current authenticator code from the secret in `totpSecretEnv`.
+
 When a response says the page landed on a login screen, retry with
 `storageState`. `suggest-fix` takes `storageState` and `headers` too when you heal
 against a live `url`.
@@ -183,6 +212,14 @@ one verdict **per test** (passes, failures, duration spread, first error):
   tests that flaked; `fix: true` applies the mechanical rewrites and re-runs them.
 - **NOT REPRODUCING**: passed every run. Report that the failure was one-off.
 
+If a FLAKY test cannot be fixed right away and is blocking other work, offer
+`quarantine` (0.7.0+) with `action: "add"`, the test (`index` of the last run's
+failure, or `"file › title"`), an `owner` and a `reason` (an issue link is best).
+It keeps running and being reported, but stops failing the run until the entry
+expires (default 14 days). Ask the user before adding one; never quarantine a
+CONSISTENTLY FAILING test, which is a real failure. `quarantine` with no
+arguments lists the entries and the expired ones.
+
 When a test is FLAKY and the suite runs in parallel, call `diagnose-flaky` again
 with `isolate: true`. It repeats the tests fully parallel, then repeats the
 failing ones with one worker, and reads each one:
@@ -244,7 +281,7 @@ with the commit it tested. `analyze-history` views:
   `selector` for one region) returns the accessibility snapshot and a
   `toMatchAriaSnapshot` assertion to paste into a spec.
 - **Set up CI:** when the user wants the same diagnosis on every pull request,
-  point them to the GitHub Action (`uses: xsignon-secure/E2E@v0.6.1`) or the
+  point them to the GitHub Action (`uses: xsignon-secure/E2E@v0.8.0`) or the
   `npx -y playwright-e2e-mcp ci` command in `references/setup.md`. It writes the
   run, flaky verdicts and fix diffs to the job summary and one PR comment.
 - **Accessibility:** `audit-accessibility` with `url` runs axe-core against
@@ -284,6 +321,7 @@ When you finish, tell the user, in this order:
 
 - Do not raise timeouts, add retries, add `waitForTimeout`, or delete or
   `test.skip` a test to make a run green, unless the user explicitly asks.
+  `check-test-change` catches these; run it after every test edit.
 - Do not accept a new visual baseline without the user's confirmation.
 - Do not pass `allowExpectationUpdate: true` to `suggest-fix` unless the user
   confirms the new text is intended; a changed expected value can be a real bug.

package/skill/playwright-e2e-mcp/references/setup.md

@@ -82,6 +82,13 @@ Set these in the server's `env` block. None of them are secrets except
 | `PW_MCP_BLOCK_PRIVATE_URLS` | off for stdio | `1` makes the URL tools refuse loopback, private-network and cloud-metadata addresses |
 | `PW_MCP_STORAGE_STATE` | none | Default Playwright storageState JSON (inside the project) for the page tools, so signed-in pages open logged in |
 | `PW_MCP_SHUFFLE_SEEDS` | random | Seeds for `diagnose-flaky`'s `order` pass (comma separated), to replay reported orders |
+| `PW_MCP_LOGIN_ENV` | — | Extra variables `save-login` may type through `{{env:NAME}}`, comma separated (default: only `E2E_*`, `TEST_*`, `PW_*`, `PLAYWRIGHT_*`, `LOGIN_*`) |
+| `PW_MCP_PRO_KEY` / `PW_MCP_PRO_URL` | — | Optional paid Pro: CI runs uploaded with `upload` show up in `analyze-history` (`source: both`). Unset = no network calls |
+| `PW_MCP_BLOCK_WRITES` | off | `1` makes the page tools abort POST, PUT, PATCH and DELETE requests that no mock or HAR answers (0.8.0+) |
+| `PW_MCP_PYTHON` | project venv, then `python3` | The Python used for pytest-playwright projects (0.8.0+) |
+| `PW_MCP_PROTOCOL` | both | `legacy` stops offering the 2026-07-28 MCP revision (0.8.0+) |
+| `PW_MCP_SKILLS` | on | `0` stops serving this skill over the MCP Skills extension (0.8.0+) |
+| `PW_MCP_NO_UPDATE_CHECK` | off | `1` stops `doctor` asking npm whether a newer version is out (0.8.0+) |
 | `PW_MCP_HISTORY` | on | `0` stops recording runs to `<project>/.playwright-e2e-mcp/history.jsonl` (this turns off `analyze-history`) |
 | `LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error` or `silent` |
 | `PW_MCP_HTTP_TOKEN` | none | HTTP bridge only: bearer token that unlocks all tools |
@@ -112,7 +119,7 @@ Exit code 0 means passed, 1 tests failed, 2 the run itself failed. On GitHub
 Actions it also writes to the job summary. As an Action:
 
 ```yaml
-- uses: xsignon-secure/E2E@v0.6.1
+- uses: xsignon-secure/E2E@v0.8.0
   with:
     flaky-runs: 3
     suggest: 2
@@ -120,3 +127,7 @@ Actions it also writes to the job summary. As an Action:
 
 It keeps one PR comment up to date when the run fails (needs
 `pull-requests: write`).
+
+From 0.7.0, `npx -y playwright-e2e-mcp guard --base origin/main` (or the
+Action's `guard: true` input) fails the job when a changed test was made to
+pass by checking less, and `ci` honours `playwright-quarantine.json`.

package/skill/playwright-e2e-mcp/references/tools.md

@@ -68,7 +68,7 @@ becomes the last run for `get-failure`, `suggest-fix` and `diagnose-flaky`.
 | `view` | `elements` \| `locators` \| `aria` | `locators`: compact map of interactive elements with verified locators; `aria` (0.5.0+): accessibility snapshot of the page or of `selector`, with a `toMatchAriaSnapshot` assertion |
 | `storageState` | string | Playwright storageState JSON inside the project (signed-in session); defaults to `PW_MCP_STORAGE_STATE` |
 | `headers` | object | Extra HTTP headers |
-| `actions` | array | Up to 20 steps after load: `{ type: click\|dblclick\|fill\|press\|check\|uncheck\|select\|hover\|wait\|goto, locator?, value?, url?, ms? }`. Locators may start with `frameLocator('#frame')` or use `.contentFrame()` for iframes (0.6.1+) |
+| `actions` | array | Up to 20 steps after load: `{ type: click\|dblclick\|fill\|press\|check\|uncheck\|select\|hover\|wait\|goto, locator?, value?, url?, ms? }`. Locators may start with `frameLocator('#frame')` or use `.contentFrame()` for iframes (0.6.1+). `{ type: 'switchTab', value?: 'last'\|'first'\|'2'\|text in URL or title }` moves to a popup or new tab (0.8.0+) |
 | `actionTimeoutMs` | number | How long each action waits for its element (0.6.1+, default 10000) |
 | `routes` | array | Up to 20 network mocks before load, first match wins: `{ url (glob), method?, status?, json? \| body?, contentType?, headers?, abort?, delayMs? }` (0.5.0+). The result reports hits per mock |
 | `har` | object | `{ path, mode?: replay\|record, url?, notFound?: abort\|fallback }` (0.5.0+): replay requests from a HAR inside the project, or record the traffic to one. `routes` still win |
@@ -278,3 +278,44 @@ mechanically. Files rank by findings weighted by their flaky rate in the history
 Runs in a temporary git worktree with the current `node_modules` linked in;
 untestable commits are skipped. `status` is `found`, `ambiguous`, `max-steps`,
 `not-failing` (passes at bad) or `good-fails`.
+
+## save-login (0.7.0+)
+
+| Argument | Type | Notes |
+| --- | --- | --- |
+| `url` | string | Login page (required) |
+| `actions` | array | Login steps as in `inspect-page`; fill values may use `{{env:NAME}}` and `{{totp}}` |
+| `verify` | object | `url` (page to check, e.g. `/account`), `visible` (locator only a signed-in user sees), `notUrl` (bad if the URL contains it, e.g. `/login`) |
+| `name` / `path` | string | Saved to `playwright/.auth/<name>.json` (default `user`) or `path` |
+| `totpSecretEnv` | string | Variable holding the authenticator secret (base32 or `otpauth://`) |
+| `reuse` | boolean | Keep a saved session that still passes `verify` (default true) |
+
+`status` is `saved`, `valid` (reused, nothing typed) or `failed` (no file written).
+Only `E2E_*`, `TEST_*`, `PW_*`, `PLAYWRIGHT_*`, `LOGIN_*` and names in
+`PW_MCP_LOGIN_ENV` can be read through `{{env:…}}`.
+
+## check-test-change (0.7.0+)
+
+| Argument | Type | Notes |
+| --- | --- | --- |
+| `base` | string | Git ref (default `HEAD`: the uncommitted changes; `origin/main` for the branch) |
+| `files` | string[] | Only these files |
+| `file` + `after` | string | Check a proposed full file content before writing it |
+
+`status` is `OK`, `WARN` or `BLOCK`; `ok` is false only on BLOCK. BLOCK: fewer
+assertions in a test, a removed or skipped test, `.only`, a deleted spec. WARN:
+`expect.soft`, a weaker matcher, `waitForTimeout`, `force: true`, a swallowed
+error, a raised timeout, retries or screenshot tolerance.
+
+## quarantine (0.7.0+)
+
+| Argument | Type | Notes |
+| --- | --- | --- |
+| `action` | string | `list` (default), `add`, `remove` |
+| `test` | string | `'file › title'`; or `file` + `title`; or `index` (last run's failure) |
+| `owner` / `reason` | string | Required for `add` |
+| `days` | number | 1–90, default 14 |
+
+Stored in `playwright-quarantine.json` (commit it). A quarantined, unexpired
+failure is listed under 🧊 and does not fail `run-test` or `ci`; `run.quarantined`
+counts them. Expired entries block again.