playwright 1.58.0-alpha-2025-11-21 → 1.58.0-alpha-2025-11-22

package/lib/mcp/browser/browserContextFactory.js

@@ -29,7 +29,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var browserContextFactory_exports = {};
 __export(browserContextFactory_exports, {
   SharedContextFactory: () => SharedContextFactory,
-  contextFactory: () => contextFactory
+  contextFactory: () => contextFactory,
+  identityBrowserContextFactory: () => identityBrowserContextFactory
 });
 module.exports = __toCommonJS(browserContextFactory_exports);
 var import_crypto = __toESM(require("crypto"));
@@ -53,6 +54,17 @@ function contextFactory(config) {
     return new IsolatedContextFactory(config);
   return new PersistentContextFactory(config);
 }
+function identityBrowserContextFactory(browserContext) {
+  return {
+    createContext: async (clientInfo, abortSignal, toolName) => {
+      return {
+        browserContext,
+        close: async () => {
+        }
+      };
+    }
+  };
+}
 class BaseContextFactory {
   constructor(name, config) {
     this._logName = name;
@@ -292,5 +304,6 @@ async function computeTracesDir(config, clientInfo) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SharedContextFactory,
-  contextFactory
+  contextFactory,
+  identityBrowserContextFactory
 });

package/lib/mcp/browser/config.js

@@ -38,7 +38,8 @@ __export(config_exports, {
   outputFile: () => outputFile,
   resolutionParser: () => resolutionParser,
   resolveCLIConfig: () => resolveCLIConfig,
-  resolveConfig: () => resolveConfig
+  resolveConfig: () => resolveConfig,
+  semicolonSeparatedList: () => semicolonSeparatedList
 });
 module.exports = __toCommonJS(config_exports);
 var import_fs = __toESM(require("fs"));
@@ -60,6 +61,10 @@ const defaultConfig = {
       viewport: null
     }
   },
+  network: {
+    allowedOrigins: void 0,
+    blockedOrigins: void 0
+  },
   server: {},
   saveTrace: false,
   timeouts: {
@@ -88,6 +93,12 @@ async function validateConfig(config) {
         throw new Error(`Init script file does not exist: ${script}`);
     }
   }
+  if (config.browser.initPage) {
+    for (const page of config.browser.initPage) {
+      if (!await (0, import_util.fileExistsAsync)(page))
+        throw new Error(`Init page file does not exist: ${page}`);
+    }
+  }
   if (config.sharedBrowserContext && config.saveVideo)
     throw new Error("saveVideo is not supported when sharedBrowserContext is true");
 }
@@ -168,6 +179,10 @@ function configFromCLIOptions(cliOptions) {
       allowedHosts: cliOptions.allowedHosts
     },
     capabilities: cliOptions.caps,
+    network: {
+      allowedOrigins: cliOptions.allowedOrigins,
+      blockedOrigins: cliOptions.blockedOrigins
+    },
     saveSession: cliOptions.saveSession,
     saveTrace: cliOptions.saveTrace,
     saveVideo: cliOptions.saveVideo,
@@ -186,6 +201,8 @@ function configFromCLIOptions(cliOptions) {
 function configFromEnv() {
   const options = {};
   options.allowedHosts = commaSeparatedList(process.env.PLAYWRIGHT_MCP_ALLOWED_HOSTNAMES);
+  options.allowedOrigins = semicolonSeparatedList(process.env.PLAYWRIGHT_MCP_ALLOWED_ORIGINS);
+  options.blockedOrigins = semicolonSeparatedList(process.env.PLAYWRIGHT_MCP_BLOCKED_ORIGINS);
   options.blockServiceWorkers = envToBoolean(process.env.PLAYWRIGHT_MCP_BLOCK_SERVICE_WORKERS);
   options.browser = envToString(process.env.PLAYWRIGHT_MCP_BROWSER);
   options.caps = commaSeparatedList(process.env.PLAYWRIGHT_MCP_CAPS);
@@ -285,6 +302,10 @@ function mergeConfig(base, overrides) {
     ...pickDefined(base),
     ...pickDefined(overrides),
     browser,
+    network: {
+      ...pickDefined(base.network),
+      ...pickDefined(overrides.network)
+    },
     server: {
       ...pickDefined(base.server),
       ...pickDefined(overrides.server)
@@ -295,6 +316,11 @@ function mergeConfig(base, overrides) {
     }
   };
 }
+function semicolonSeparatedList(value) {
+  if (!value)
+    return void 0;
+  return value.split(";").map((v) => v.trim());
+}
 function commaSeparatedList(value) {
   if (!value)
     return void 0;
@@ -364,5 +390,6 @@ function sanitizeForFilePath(s) {
   outputFile,
   resolutionParser,
   resolveCLIConfig,
-  resolveConfig
+  resolveConfig,
+  semicolonSeparatedList
 });

package/lib/mcp/browser/context.js

@@ -75,7 +75,6 @@ class Context {
     const { browserContext } = await this._ensureBrowserContext();
     const page = await browserContext.newPage();
     this._currentTab = this._tabs.find((t) => t.page === page);
-    await this._currentTab.initializedPromise;
     return this._currentTab;
   }
   async selectTab(index) {
@@ -169,6 +168,17 @@ class Context {
     await this.closeBrowserContext();
     Context._allContexts.delete(this);
   }
+  async _setupRequestInterception(context) {
+    if (this.config.network?.allowedOrigins?.length) {
+      await context.route("**", (route) => route.abort("blockedbyclient"));
+      for (const origin of this.config.network.allowedOrigins)
+        await context.route(originOrHostGlob(origin), (route) => route.continue());
+    }
+    if (this.config.network?.blockedOrigins?.length) {
+      for (const origin of this.config.network.blockedOrigins)
+        await context.route(originOrHostGlob(origin), (route) => route.abort("blockedbyclient"));
+    }
+  }
   async ensureBrowserContext() {
     const { browserContext } = await this._ensureBrowserContext();
     return browserContext;
@@ -189,6 +199,7 @@ class Context {
       import_playwright_core.selectors.setTestIdAttribute(this.config.testIdAttribute);
     const result = await this._browserContextFactory.createContext(this._clientInfo, this._abortController.signal, this._runningToolName);
     const { browserContext } = result;
+    await this._setupRequestInterception(browserContext);
     if (this.sessionLog)
       await InputRecorder.create(this, browserContext);
     for (const page of browserContext.pages())
@@ -213,6 +224,15 @@ class Context {
     };
   }
 }
+function originOrHostGlob(originOrHost) {
+  try {
+    const url = new URL(originOrHost);
+    if (url.origin !== "null")
+      return `${url.origin}/**`;
+  } catch {
+  }
+  return `*://${originOrHost}/**`;
+}
 class InputRecorder {
   constructor(context, browserContext) {
     this._context = context;

package/lib/mcp/browser/tab.js

@@ -65,7 +65,7 @@ class Tab extends import_events.EventEmitter {
     page.setDefaultNavigationTimeout(this.context.config.timeouts.navigation);
     page.setDefaultTimeout(this.context.config.timeouts.action);
     page[tabSymbol] = this;
-    this.initializedPromise = this._initialize();
+    this._initializedPromise = this._initialize();
   }
   static forPage(page) {
     return page[tabSymbol];
@@ -151,9 +151,11 @@ class Tab extends import_events.EventEmitter {
     return this === this.context.currentTab();
   }
   async waitForLoadState(state, options) {
+    await this._initializedPromise;
     await (0, import_utils2.callOnPageNoTrace)(this.page, (page) => page.waitForLoadState(state, options).catch(import_log.logUnhandledError));
   }
   async navigate(url) {
+    await this._initializedPromise;
     this._clearCollectedArtifacts();
     const downloadEvent = (0, import_utils2.callOnPageNoTrace)(this.page, (page) => page.waitForEvent("download").catch(import_log.logUnhandledError));
     try {
@@ -175,14 +177,15 @@ class Tab extends import_events.EventEmitter {
     await this.waitForLoadState("load", { timeout: 5e3 });
   }
   async consoleMessages(type) {
-    await this.initializedPromise;
+    await this._initializedPromise;
     return this._consoleMessages.filter((message) => type ? message.type === type : true);
   }
   async requests() {
-    await this.initializedPromise;
+    await this._initializedPromise;
     return this._requests;
   }
   async captureSnapshot() {
+    await this._initializedPromise;
     let tabSnapshot;
     const modalStates = await this._raceAgainstModalStates(async () => {
       const snapshot = await this.page._snapshotForAI({ track: "response" });
@@ -228,12 +231,15 @@ class Tab extends import_events.EventEmitter {
     ]);
   }
   async waitForCompletion(callback) {
+    await this._initializedPromise;
     await this._raceAgainstModalStates(() => (0, import_utils2.waitForCompletion)(this, callback));
   }
   async refLocator(params) {
+    await this._initializedPromise;
     return (await this.refLocators([params]))[0];
   }
   async refLocators(params) {
+    await this._initializedPromise;
     return Promise.all(params.map(async (param) => {
       try {
         const locator = this.page.locator(`aria-ref=${param.ref}`).describe(param.element);
@@ -250,7 +256,8 @@ class Tab extends import_events.EventEmitter {
       return;
     }
     await (0, import_utils2.callOnPageNoTrace)(this.page, (page) => {
-      return page.evaluate(() => new Promise((f) => setTimeout(f, 1e3)));
+      return page.evaluate(() => new Promise((f) => setTimeout(f, 1e3))).catch(() => {
+      });
     });
   }
 }

package/lib/mcp/program.js

@@ -42,7 +42,7 @@ var import_proxyBackend = require("./sdk/proxyBackend");
 var import_browserServerBackend = require("./browser/browserServerBackend");
 var import_extensionContextFactory = require("./extension/extensionContextFactory");
 function decorateCommand(command, version) {
-  command.option("--allowed-hosts <hosts...>", "comma-separated list of hosts this server is allowed to serve from. Defaults to the host the server is bound to. Pass '*' to disable the host check.", import_config.commaSeparatedList).option("--block-service-workers", "block service workers").option("--browser <browser>", "browser or chrome channel to use, possible values: chrome, firefox, webkit, msedge.").option("--caps <caps>", "comma-separated list of additional capabilities to enable, possible values: vision, pdf.", import_config.commaSeparatedList).option("--cdp-endpoint <endpoint>", "CDP endpoint to connect to.").option("--cdp-header <headers...>", "CDP headers to send with the connect request, multiple can be specified.", import_config.headerParser).option("--config <path>", "path to the configuration file.").option("--device <device>", 'device to emulate, for example: "iPhone 15"').option("--executable-path <path>", "path to the browser executable.").option("--extension", 'Connect to a running browser instance (Edge/Chrome only). Requires the "Playwright MCP Bridge" browser extension to be installed.').option("--grant-permissions <permissions...>", 'List of permissions to grant to the browser context, for example "geolocation", "clipboard-read", "clipboard-write".', import_config.commaSeparatedList).option("--headless", "run browser in headless mode, headed by default").option("--host <host>", "host to bind server to. Default is localhost. Use 0.0.0.0 to bind to all interfaces.").option("--ignore-https-errors", "ignore https errors").option("--init-page <path...>", "path to TypeScript file to evaluate on Playwright page object").option("--init-script <path...>", "path to JavaScript file to add as an initialization script. The script will be evaluated in every page before any of the page's scripts. Can be specified multiple times.").option("--isolated", "keep the browser profile in memory, do not save it to disk.").option("--image-responses <mode>", 'whether to send image responses to the client. Can be "allow" or "omit", Defaults to "allow".').option("--no-sandbox", "disable the sandbox for all process types that are normally sandboxed.").option("--output-dir <path>", "path to the directory for output files.").option("--port <port>", "port to listen on for SSE transport.").option("--proxy-bypass <bypass>", 'comma-separated domains to bypass proxy, for example ".com,chromium.org,.domain.com"').option("--proxy-server <proxy>", 'specify proxy server, for example "http://myproxy:3128" or "socks5://myproxy:8080"').option("--save-session", "Whether to save the Playwright MCP session into the output directory.").option("--save-trace", "Whether to save the Playwright Trace of the session into the output directory.").option("--save-video <size>", 'Whether to save the video of the session into the output directory. For example "--save-video=800x600"', import_config.resolutionParser.bind(null, "--save-video")).option("--secrets <path>", "path to a file containing secrets in the dotenv format", import_config.dotenvFileLoader).option("--shared-browser-context", "reuse the same browser context between all connected HTTP clients.").option("--storage-state <path>", "path to the storage state file for isolated sessions.").option("--test-id-attribute <attribute>", 'specify the attribute to use for test ids, defaults to "data-testid"').option("--timeout-action <timeout>", "specify action timeout in milliseconds, defaults to 5000ms", import_config.numberParser).option("--timeout-navigation <timeout>", "specify navigation timeout in milliseconds, defaults to 60000ms", import_config.numberParser).option("--user-agent <ua string>", "specify user agent string").option("--user-data-dir <path>", "path to the user data directory. If not specified, a temporary directory will be created.").option("--viewport-size <size>", 'specify browser viewport size in pixels, for example "1280x720"', import_config.resolutionParser.bind(null, "--viewport-size")).addOption(new import_utilsBundle.ProgramOption("--connect-tool", "Allow to switch between different browser connection methods.").hideHelp()).addOption(new import_utilsBundle.ProgramOption("--vision", "Legacy option, use --caps=vision instead").hideHelp()).action(async (options) => {
+  command.option("--allowed-hosts <hosts...>", "comma-separated list of hosts this server is allowed to serve from. Defaults to the host the server is bound to. Pass '*' to disable the host check.", import_config.commaSeparatedList).option("--allowed-origins <origins>", "semicolon-separated list of TRUSTED origins to allow the browser to request. Default is to allow all.\nImportant: *does not* serve as a security boundary and *does not* affect redirects. ", import_config.semicolonSeparatedList).option("--blocked-origins <origins>", "semicolon-separated list of origins to block the browser from requesting. Blocklist is evaluated before allowlist. If used without the allowlist, requests not matching the blocklist are still allowed.\nImportant: *does not* serve as a security boundary and *does not* affect redirects.", import_config.semicolonSeparatedList).option("--block-service-workers", "block service workers").option("--browser <browser>", "browser or chrome channel to use, possible values: chrome, firefox, webkit, msedge.").option("--caps <caps>", "comma-separated list of additional capabilities to enable, possible values: vision, pdf.", import_config.commaSeparatedList).option("--cdp-endpoint <endpoint>", "CDP endpoint to connect to.").option("--cdp-header <headers...>", "CDP headers to send with the connect request, multiple can be specified.", import_config.headerParser).option("--config <path>", "path to the configuration file.").option("--device <device>", 'device to emulate, for example: "iPhone 15"').option("--executable-path <path>", "path to the browser executable.").option("--extension", 'Connect to a running browser instance (Edge/Chrome only). Requires the "Playwright MCP Bridge" browser extension to be installed.').option("--grant-permissions <permissions...>", 'List of permissions to grant to the browser context, for example "geolocation", "clipboard-read", "clipboard-write".', import_config.commaSeparatedList).option("--headless", "run browser in headless mode, headed by default").option("--host <host>", "host to bind server to. Default is localhost. Use 0.0.0.0 to bind to all interfaces.").option("--ignore-https-errors", "ignore https errors").option("--init-page <path...>", "path to TypeScript file to evaluate on Playwright page object").option("--init-script <path...>", "path to JavaScript file to add as an initialization script. The script will be evaluated in every page before any of the page's scripts. Can be specified multiple times.").option("--isolated", "keep the browser profile in memory, do not save it to disk.").option("--image-responses <mode>", 'whether to send image responses to the client. Can be "allow" or "omit", Defaults to "allow".').option("--no-sandbox", "disable the sandbox for all process types that are normally sandboxed.").option("--output-dir <path>", "path to the directory for output files.").option("--port <port>", "port to listen on for SSE transport.").option("--proxy-bypass <bypass>", 'comma-separated domains to bypass proxy, for example ".com,chromium.org,.domain.com"').option("--proxy-server <proxy>", 'specify proxy server, for example "http://myproxy:3128" or "socks5://myproxy:8080"').option("--save-session", "Whether to save the Playwright MCP session into the output directory.").option("--save-trace", "Whether to save the Playwright Trace of the session into the output directory.").option("--save-video <size>", 'Whether to save the video of the session into the output directory. For example "--save-video=800x600"', import_config.resolutionParser.bind(null, "--save-video")).option("--secrets <path>", "path to a file containing secrets in the dotenv format", import_config.dotenvFileLoader).option("--shared-browser-context", "reuse the same browser context between all connected HTTP clients.").option("--storage-state <path>", "path to the storage state file for isolated sessions.").option("--test-id-attribute <attribute>", 'specify the attribute to use for test ids, defaults to "data-testid"').option("--timeout-action <timeout>", "specify action timeout in milliseconds, defaults to 5000ms", import_config.numberParser).option("--timeout-navigation <timeout>", "specify navigation timeout in milliseconds, defaults to 60000ms", import_config.numberParser).option("--user-agent <ua string>", "specify user agent string").option("--user-data-dir <path>", "path to the user data directory. If not specified, a temporary directory will be created.").option("--viewport-size <size>", 'specify browser viewport size in pixels, for example "1280x720"', import_config.resolutionParser.bind(null, "--viewport-size")).addOption(new import_utilsBundle.ProgramOption("--connect-tool", "Allow to switch between different browser connection methods.").hideHelp()).addOption(new import_utilsBundle.ProgramOption("--vision", "Legacy option, use --caps=vision instead").hideHelp()).action(async (options) => {
     (0, import_watchdog.setupExitWatchdog)();
     if (options.vision) {
       console.error("The --vision option is deprecated, use --caps=vision instead");

package/lib/mcp/sdk/bundle.js

@@ -32,6 +32,7 @@ __export(bundle_exports, {
   Client: () => Client,
   ListRootsRequestSchema: () => ListRootsRequestSchema,
   ListToolsRequestSchema: () => ListToolsRequestSchema,
+  Loop: () => Loop,
   PingRequestSchema: () => PingRequestSchema,
   ProgressNotificationSchema: () => ProgressNotificationSchema,
   SSEClientTransport: () => SSEClientTransport,
@@ -60,6 +61,7 @@ const ListRootsRequestSchema = bundle.ListRootsRequestSchema;
 const ProgressNotificationSchema = bundle.ProgressNotificationSchema;
 const ListToolsRequestSchema = bundle.ListToolsRequestSchema;
 const PingRequestSchema = bundle.PingRequestSchema;
+const Loop = bundle.Loop;
 const z = bundle.z;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -67,6 +69,7 @@ const z = bundle.z;
   Client,
   ListRootsRequestSchema,
   ListToolsRequestSchema,
+  Loop,
   PingRequestSchema,
   ProgressNotificationSchema,
   SSEClientTransport,

package/lib/mcp/sdk/proxyBackend.js

@@ -116,7 +116,7 @@ Error: ${error}
     });
     client.setRequestHandler(mcpBundle.ListRootsRequestSchema, () => ({ roots: this._clientInfo?.roots || [] }));
     client.setRequestHandler(mcpBundle.PingRequestSchema, () => ({}));
-    const transport = await factory.connect();
+    const transport = factory.connect();
     await client.connect(transport);
     this._currentClient = client;
     return client;

package/lib/mcp/sdk/server.js

@@ -32,6 +32,7 @@ __export(server_exports, {
   createServer: () => createServer,
   firstRootPath: () => firstRootPath,
   start: () => start,
+  wrapInClient: () => wrapInClient,
   wrapInProcess: () => wrapInProcess
 });
 module.exports = __toCommonJS(server_exports);
@@ -46,10 +47,18 @@ async function connect(factory, transport, runHeartbeat) {
   const server = createServer(factory.name, factory.version, factory.create(), runHeartbeat);
   await server.connect(transport);
 }
-async function wrapInProcess(backend) {
+function wrapInProcess(backend) {
   const server = createServer("Internal", "0.0.0", backend, false);
   return new import_inProcessTransport.InProcessTransport(server);
 }
+async function wrapInClient(backend, options) {
+  const server = createServer("Internal", "0.0.0", backend, false);
+  const transport = new import_inProcessTransport.InProcessTransport(server);
+  const client = new mcpBundle.Client({ name: options.name, version: options.version });
+  await client.connect(transport);
+  await client.ping();
+  return client;
+}
 function createServer(name, version, backend, runHeartbeat) {
   const server = new mcpBundle.Server({ name, version }, {
     capabilities: {
@@ -194,5 +203,6 @@ function mergeTextParts(result) {
   createServer,
   firstRootPath,
   start,
+  wrapInClient,
   wrapInProcess
 });

package/lib/mcp/test/browserBackend.js

@@ -25,13 +25,14 @@ var import_config = require("../browser/config");
 var import_browserServerBackend = require("../browser/browserServerBackend");
 var import_tab = require("../browser/tab");
 var import_util = require("../../util");
+var import_browserContextFactory = require("../browser/browserContextFactory");
 function createCustomMessageHandler(testInfo, context) {
   let backend;
   return async (data) => {
     if (data.initialize) {
       if (backend)
         throw new Error("MCP backend is already initialized");
-      backend = new import_browserServerBackend.BrowserServerBackend({ ...import_config.defaultConfig, capabilities: ["testing"] }, identityFactory(context));
+      backend = new import_browserServerBackend.BrowserServerBackend({ ...import_config.defaultConfig, capabilities: ["testing"] }, (0, import_browserContextFactory.identityBrowserContextFactory)(context));
       await backend.initialize(data.initialize.clientInfo);
       const pausedMessage = await generatePausedMessage(testInfo, context);
       return { initialize: { pausedMessage } };
@@ -91,17 +92,6 @@ async function generatePausedMessage(testInfo, context) {
     lines.push(`### Task`, `Try recovering from the error prior to continuing`);
   return lines.join("\n");
 }
-function identityFactory(browserContext) {
-  return {
-    createContext: async (clientInfo, abortSignal, toolName) => {
-      return {
-        browserContext,
-        close: async () => {
-        }
-      };
-    }
-  };
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createCustomMessageHandler

package/lib/mcp/test/testBackend.js

@@ -39,7 +39,7 @@ var plannerTools = __toESM(require("./plannerTools.js"));
 var import_tools = require("../browser/tools");
 var import_bundle = require("../sdk/bundle");
 class TestServerBackend {
-  constructor(configOption, options) {
+  constructor(configPath, options) {
     this.name = "Playwright";
     this.version = "0.0.1";
     this._tools = [
@@ -55,10 +55,10 @@ class TestServerBackend {
       ...import_tools.browserTools.map((tool) => wrapBrowserTool(tool))
     ];
     this._options = options || {};
-    this._configOption = configOption;
+    this._configPath = configPath;
   }
   async initialize(clientInfo) {
-    this._context = new import_testContext.TestContext(clientInfo, this._configOption, this._options);
+    this._context = new import_testContext.TestContext(clientInfo, this._configPath, this._options);
   }
   async listTools() {
     return this._tools.map((tool) => mcp.toMcpTool(tool.schema));
@@ -74,7 +74,7 @@ class TestServerBackend {
     }
   }
   serverClosed() {
-    void this._context.close();
+    void this._context?.close();
   }
 }
 const typesWithIntent = ["action", "assertion", "input"];