playwright 1.58.0-alpha-2025-11-21 → 1.58.0-alpha-1763757971000

package/lib/mcp/browser/config.js

@@ -38,7 +38,8 @@ __export(config_exports, {
   outputFile: () => outputFile,
   resolutionParser: () => resolutionParser,
   resolveCLIConfig: () => resolveCLIConfig,
-  resolveConfig: () => resolveConfig
+  resolveConfig: () => resolveConfig,
+  semicolonSeparatedList: () => semicolonSeparatedList
 });
 module.exports = __toCommonJS(config_exports);
 var import_fs = __toESM(require("fs"));
@@ -60,6 +61,10 @@ const defaultConfig = {
       viewport: null
     }
   },
+  network: {
+    allowedOrigins: void 0,
+    blockedOrigins: void 0
+  },
   server: {},
   saveTrace: false,
   timeouts: {
@@ -88,6 +93,12 @@ async function validateConfig(config) {
         throw new Error(`Init script file does not exist: ${script}`);
     }
   }
+  if (config.browser.initPage) {
+    for (const page of config.browser.initPage) {
+      if (!await (0, import_util.fileExistsAsync)(page))
+        throw new Error(`Init page file does not exist: ${page}`);
+    }
+  }
   if (config.sharedBrowserContext && config.saveVideo)
     throw new Error("saveVideo is not supported when sharedBrowserContext is true");
 }
@@ -168,6 +179,10 @@ function configFromCLIOptions(cliOptions) {
       allowedHosts: cliOptions.allowedHosts
     },
     capabilities: cliOptions.caps,
+    network: {
+      allowedOrigins: cliOptions.allowedOrigins,
+      blockedOrigins: cliOptions.blockedOrigins
+    },
     saveSession: cliOptions.saveSession,
     saveTrace: cliOptions.saveTrace,
     saveVideo: cliOptions.saveVideo,
@@ -186,6 +201,8 @@ function configFromCLIOptions(cliOptions) {
 function configFromEnv() {
   const options = {};
   options.allowedHosts = commaSeparatedList(process.env.PLAYWRIGHT_MCP_ALLOWED_HOSTNAMES);
+  options.allowedOrigins = semicolonSeparatedList(process.env.PLAYWRIGHT_MCP_ALLOWED_ORIGINS);
+  options.blockedOrigins = semicolonSeparatedList(process.env.PLAYWRIGHT_MCP_BLOCKED_ORIGINS);
   options.blockServiceWorkers = envToBoolean(process.env.PLAYWRIGHT_MCP_BLOCK_SERVICE_WORKERS);
   options.browser = envToString(process.env.PLAYWRIGHT_MCP_BROWSER);
   options.caps = commaSeparatedList(process.env.PLAYWRIGHT_MCP_CAPS);
@@ -285,6 +302,10 @@ function mergeConfig(base, overrides) {
     ...pickDefined(base),
     ...pickDefined(overrides),
     browser,
+    network: {
+      ...pickDefined(base.network),
+      ...pickDefined(overrides.network)
+    },
     server: {
       ...pickDefined(base.server),
       ...pickDefined(overrides.server)
@@ -295,6 +316,11 @@ function mergeConfig(base, overrides) {
     }
   };
 }
+function semicolonSeparatedList(value) {
+  if (!value)
+    return void 0;
+  return value.split(";").map((v) => v.trim());
+}
 function commaSeparatedList(value) {
   if (!value)
     return void 0;
@@ -364,5 +390,6 @@ function sanitizeForFilePath(s) {
   outputFile,
   resolutionParser,
   resolveCLIConfig,
-  resolveConfig
+  resolveConfig,
+  semicolonSeparatedList
 });

package/lib/mcp/browser/context.js

@@ -75,7 +75,6 @@ class Context {
     const { browserContext } = await this._ensureBrowserContext();
     const page = await browserContext.newPage();
     this._currentTab = this._tabs.find((t) => t.page === page);
-    await this._currentTab.initializedPromise;
     return this._currentTab;
   }
   async selectTab(index) {
@@ -169,6 +168,17 @@ class Context {
     await this.closeBrowserContext();
     Context._allContexts.delete(this);
   }
+  async _setupRequestInterception(context) {
+    if (this.config.network?.allowedOrigins?.length) {
+      await context.route("**", (route) => route.abort("blockedbyclient"));
+      for (const origin of this.config.network.allowedOrigins)
+        await context.route(originOrHostGlob(origin), (route) => route.continue());
+    }
+    if (this.config.network?.blockedOrigins?.length) {
+      for (const origin of this.config.network.blockedOrigins)
+        await context.route(originOrHostGlob(origin), (route) => route.abort("blockedbyclient"));
+    }
+  }
   async ensureBrowserContext() {
     const { browserContext } = await this._ensureBrowserContext();
     return browserContext;
@@ -189,6 +199,7 @@ class Context {
       import_playwright_core.selectors.setTestIdAttribute(this.config.testIdAttribute);
     const result = await this._browserContextFactory.createContext(this._clientInfo, this._abortController.signal, this._runningToolName);
     const { browserContext } = result;
+    await this._setupRequestInterception(browserContext);
     if (this.sessionLog)
       await InputRecorder.create(this, browserContext);
     for (const page of browserContext.pages())
@@ -213,6 +224,15 @@ class Context {
     };
   }
 }
+function originOrHostGlob(originOrHost) {
+  try {
+    const url = new URL(originOrHost);
+    if (url.origin !== "null")
+      return `${url.origin}/**`;
+  } catch {
+  }
+  return `*://${originOrHost}/**`;
+}
 class InputRecorder {
   constructor(context, browserContext) {
     this._context = context;

package/lib/mcp/browser/tab.js

@@ -65,7 +65,7 @@ class Tab extends import_events.EventEmitter {
     page.setDefaultNavigationTimeout(this.context.config.timeouts.navigation);
     page.setDefaultTimeout(this.context.config.timeouts.action);
     page[tabSymbol] = this;
-    this.initializedPromise = this._initialize();
+    this._initializedPromise = this._initialize();
   }
   static forPage(page) {
     return page[tabSymbol];
@@ -151,9 +151,11 @@ class Tab extends import_events.EventEmitter {
     return this === this.context.currentTab();
   }
   async waitForLoadState(state, options) {
+    await this._initializedPromise;
     await (0, import_utils2.callOnPageNoTrace)(this.page, (page) => page.waitForLoadState(state, options).catch(import_log.logUnhandledError));
   }
   async navigate(url) {
+    await this._initializedPromise;
     this._clearCollectedArtifacts();
     const downloadEvent = (0, import_utils2.callOnPageNoTrace)(this.page, (page) => page.waitForEvent("download").catch(import_log.logUnhandledError));
     try {
@@ -175,14 +177,15 @@ class Tab extends import_events.EventEmitter {
     await this.waitForLoadState("load", { timeout: 5e3 });
   }
   async consoleMessages(type) {
-    await this.initializedPromise;
+    await this._initializedPromise;
     return this._consoleMessages.filter((message) => type ? message.type === type : true);
   }
   async requests() {
-    await this.initializedPromise;
+    await this._initializedPromise;
     return this._requests;
   }
   async captureSnapshot() {
+    await this._initializedPromise;
     let tabSnapshot;
     const modalStates = await this._raceAgainstModalStates(async () => {
       const snapshot = await this.page._snapshotForAI({ track: "response" });
@@ -228,12 +231,15 @@ class Tab extends import_events.EventEmitter {
     ]);
   }
   async waitForCompletion(callback) {
+    await this._initializedPromise;
     await this._raceAgainstModalStates(() => (0, import_utils2.waitForCompletion)(this, callback));
   }
   async refLocator(params) {
+    await this._initializedPromise;
     return (await this.refLocators([params]))[0];
   }
   async refLocators(params) {
+    await this._initializedPromise;
     return Promise.all(params.map(async (param) => {
       try {
         const locator = this.page.locator(`aria-ref=${param.ref}`).describe(param.element);
@@ -250,7 +256,8 @@ class Tab extends import_events.EventEmitter {
       return;
     }
     await (0, import_utils2.callOnPageNoTrace)(this.page, (page) => {
-      return page.evaluate(() => new Promise((f) => setTimeout(f, 1e3)));
+      return page.evaluate(() => new Promise((f) => setTimeout(f, 1e3))).catch(() => {
+      });
     });
   }
 }

package/lib/mcp/program.js

@@ -42,7 +42,7 @@ var import_proxyBackend = require("./sdk/proxyBackend");
 var import_browserServerBackend = require("./browser/browserServerBackend");
 var import_extensionContextFactory = require("./extension/extensionContextFactory");
 function decorateCommand(command, version) {
-  command.option("--allowed-hosts <hosts...>", "comma-separated list of hosts this server is allowed to serve from. Defaults to the host the server is bound to. Pass '*' to disable the host check.", import_config.commaSeparatedList).option("--block-service-workers", "block service workers").option("--browser <browser>", "browser or chrome channel to use, possible values: chrome, firefox, webkit, msedge.").option("--caps <caps>", "comma-separated list of additional capabilities to enable, possible values: vision, pdf.", import_config.commaSeparatedList).option("--cdp-endpoint <endpoint>", "CDP endpoint to connect to.").option("--cdp-header <headers...>", "CDP headers to send with the connect request, multiple can be specified.", import_config.headerParser).option("--config <path>", "path to the configuration file.").option("--device <device>", 'device to emulate, for example: "iPhone 15"').option("--executable-path <path>", "path to the browser executable.").option("--extension", 'Connect to a running browser instance (Edge/Chrome only). Requires the "Playwright MCP Bridge" browser extension to be installed.').option("--grant-permissions <permissions...>", 'List of permissions to grant to the browser context, for example "geolocation", "clipboard-read", "clipboard-write".', import_config.commaSeparatedList).option("--headless", "run browser in headless mode, headed by default").option("--host <host>", "host to bind server to. Default is localhost. Use 0.0.0.0 to bind to all interfaces.").option("--ignore-https-errors", "ignore https errors").option("--init-page <path...>", "path to TypeScript file to evaluate on Playwright page object").option("--init-script <path...>", "path to JavaScript file to add as an initialization script. The script will be evaluated in every page before any of the page's scripts. Can be specified multiple times.").option("--isolated", "keep the browser profile in memory, do not save it to disk.").option("--image-responses <mode>", 'whether to send image responses to the client. Can be "allow" or "omit", Defaults to "allow".').option("--no-sandbox", "disable the sandbox for all process types that are normally sandboxed.").option("--output-dir <path>", "path to the directory for output files.").option("--port <port>", "port to listen on for SSE transport.").option("--proxy-bypass <bypass>", 'comma-separated domains to bypass proxy, for example ".com,chromium.org,.domain.com"').option("--proxy-server <proxy>", 'specify proxy server, for example "http://myproxy:3128" or "socks5://myproxy:8080"').option("--save-session", "Whether to save the Playwright MCP session into the output directory.").option("--save-trace", "Whether to save the Playwright Trace of the session into the output directory.").option("--save-video <size>", 'Whether to save the video of the session into the output directory. For example "--save-video=800x600"', import_config.resolutionParser.bind(null, "--save-video")).option("--secrets <path>", "path to a file containing secrets in the dotenv format", import_config.dotenvFileLoader).option("--shared-browser-context", "reuse the same browser context between all connected HTTP clients.").option("--storage-state <path>", "path to the storage state file for isolated sessions.").option("--test-id-attribute <attribute>", 'specify the attribute to use for test ids, defaults to "data-testid"').option("--timeout-action <timeout>", "specify action timeout in milliseconds, defaults to 5000ms", import_config.numberParser).option("--timeout-navigation <timeout>", "specify navigation timeout in milliseconds, defaults to 60000ms", import_config.numberParser).option("--user-agent <ua string>", "specify user agent string").option("--user-data-dir <path>", "path to the user data directory. If not specified, a temporary directory will be created.").option("--viewport-size <size>", 'specify browser viewport size in pixels, for example "1280x720"', import_config.resolutionParser.bind(null, "--viewport-size")).addOption(new import_utilsBundle.ProgramOption("--connect-tool", "Allow to switch between different browser connection methods.").hideHelp()).addOption(new import_utilsBundle.ProgramOption("--vision", "Legacy option, use --caps=vision instead").hideHelp()).action(async (options) => {
+  command.option("--allowed-hosts <hosts...>", "comma-separated list of hosts this server is allowed to serve from. Defaults to the host the server is bound to. Pass '*' to disable the host check.", import_config.commaSeparatedList).option("--allowed-origins <origins>", "semicolon-separated list of TRUSTED origins to allow the browser to request. Default is to allow all.\nImportant: *does not* serve as a security boundary and *does not* affect redirects. ", import_config.semicolonSeparatedList).option("--blocked-origins <origins>", "semicolon-separated list of origins to block the browser from requesting. Blocklist is evaluated before allowlist. If used without the allowlist, requests not matching the blocklist are still allowed.\nImportant: *does not* serve as a security boundary and *does not* affect redirects.", import_config.semicolonSeparatedList).option("--block-service-workers", "block service workers").option("--browser <browser>", "browser or chrome channel to use, possible values: chrome, firefox, webkit, msedge.").option("--caps <caps>", "comma-separated list of additional capabilities to enable, possible values: vision, pdf.", import_config.commaSeparatedList).option("--cdp-endpoint <endpoint>", "CDP endpoint to connect to.").option("--cdp-header <headers...>", "CDP headers to send with the connect request, multiple can be specified.", import_config.headerParser).option("--config <path>", "path to the configuration file.").option("--device <device>", 'device to emulate, for example: "iPhone 15"').option("--executable-path <path>", "path to the browser executable.").option("--extension", 'Connect to a running browser instance (Edge/Chrome only). Requires the "Playwright MCP Bridge" browser extension to be installed.').option("--grant-permissions <permissions...>", 'List of permissions to grant to the browser context, for example "geolocation", "clipboard-read", "clipboard-write".', import_config.commaSeparatedList).option("--headless", "run browser in headless mode, headed by default").option("--host <host>", "host to bind server to. Default is localhost. Use 0.0.0.0 to bind to all interfaces.").option("--ignore-https-errors", "ignore https errors").option("--init-page <path...>", "path to TypeScript file to evaluate on Playwright page object").option("--init-script <path...>", "path to JavaScript file to add as an initialization script. The script will be evaluated in every page before any of the page's scripts. Can be specified multiple times.").option("--isolated", "keep the browser profile in memory, do not save it to disk.").option("--image-responses <mode>", 'whether to send image responses to the client. Can be "allow" or "omit", Defaults to "allow".').option("--no-sandbox", "disable the sandbox for all process types that are normally sandboxed.").option("--output-dir <path>", "path to the directory for output files.").option("--port <port>", "port to listen on for SSE transport.").option("--proxy-bypass <bypass>", 'comma-separated domains to bypass proxy, for example ".com,chromium.org,.domain.com"').option("--proxy-server <proxy>", 'specify proxy server, for example "http://myproxy:3128" or "socks5://myproxy:8080"').option("--save-session", "Whether to save the Playwright MCP session into the output directory.").option("--save-trace", "Whether to save the Playwright Trace of the session into the output directory.").option("--save-video <size>", 'Whether to save the video of the session into the output directory. For example "--save-video=800x600"', import_config.resolutionParser.bind(null, "--save-video")).option("--secrets <path>", "path to a file containing secrets in the dotenv format", import_config.dotenvFileLoader).option("--shared-browser-context", "reuse the same browser context between all connected HTTP clients.").option("--storage-state <path>", "path to the storage state file for isolated sessions.").option("--test-id-attribute <attribute>", 'specify the attribute to use for test ids, defaults to "data-testid"').option("--timeout-action <timeout>", "specify action timeout in milliseconds, defaults to 5000ms", import_config.numberParser).option("--timeout-navigation <timeout>", "specify navigation timeout in milliseconds, defaults to 60000ms", import_config.numberParser).option("--user-agent <ua string>", "specify user agent string").option("--user-data-dir <path>", "path to the user data directory. If not specified, a temporary directory will be created.").option("--viewport-size <size>", 'specify browser viewport size in pixels, for example "1280x720"', import_config.resolutionParser.bind(null, "--viewport-size")).addOption(new import_utilsBundle.ProgramOption("--connect-tool", "Allow to switch between different browser connection methods.").hideHelp()).addOption(new import_utilsBundle.ProgramOption("--vision", "Legacy option, use --caps=vision instead").hideHelp()).action(async (options) => {
     (0, import_watchdog.setupExitWatchdog)();
     if (options.vision) {
       console.error("The --vision option is deprecated, use --caps=vision instead");

package/lib/runner/processHost.js

@@ -51,6 +51,9 @@ class ProcessHost extends import_events.EventEmitter {
   async startRunner(runnerParams, options = {}) {
     (0, import_utils.assert)(!this.process, "Internal error: starting the same process twice");
     this.process = import_child_process.default.fork(require.resolve("../common/process"), {
+      // Note: we pass detached:false, so that workers are in the same process group.
+      // This way Ctrl+C or a kill command can shutdown all workers in case they misbehave.
+      // Otherwise user can end up with a bunch of workers stuck in a busy loop without self-destructing.
       detached: false,
       env: {
         ...process.env,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "playwright",
-  "version": "1.58.0-alpha-2025-11-21",
+  "version": "1.58.0-alpha-1763757971000",
   "description": "A high-level API to automate web browsers",
   "repository": {
     "type": "git",
@@ -64,7 +64,7 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "playwright-core": "1.58.0-alpha-2025-11-21"
+    "playwright-core": "1.58.0-alpha-1763757971000"
   },
   "optionalDependencies": {
     "fsevents": "2.3.2"