testronaut 1.12.2 → 2.0.1

package/.github/workflows/periapsis-vulnerability-exception-request.yml

@@ -24,6 +24,9 @@ on:
       severities:
         description: "Comma-separated severities"
         required: true
+      adjustedSeverity:
+        description: "Optional re-rated severity (alert type only, must be lower than severities)"
+        required: false
       reason:
         description: "Reason for exception"
         required: true
@@ -57,6 +60,7 @@ jobs:
           INPUT_ECOSYSTEM: ${{ inputs.ecosystem }}
           INPUT_SCOPE: ${{ inputs.dependencyScope }}
           INPUT_SEVERITIES: ${{ inputs.severities }}
+          INPUT_ADJUSTED_SEVERITY: ${{ inputs.adjustedSeverity }}
           INPUT_REASON: ${{ inputs.reason }}
           INPUT_UNTIL: ${{ inputs.acceptedUntil }}
           INPUT_APPROVED_BY: ${{ inputs.approvedBy }}
@@ -71,6 +75,7 @@ jobs:
             ${INPUT_ECOSYSTEM:+--ecosystem "$INPUT_ECOSYSTEM"} \
             ${INPUT_SCOPE:+--dependency-scope "$INPUT_SCOPE"} \
             --severities "$INPUT_SEVERITIES" \
+            ${INPUT_ADJUSTED_SEVERITY:+--adjusted-severity "$INPUT_ADJUSTED_SEVERITY"} \
             --reason "$INPUT_REASON" \
             --accepted-until "$INPUT_UNTIL" \
             --approved-by "$INPUT_APPROVED_BY" \
@@ -81,6 +86,16 @@ jobs:
         uses: peter-evans/create-pull-request@v6
         with:
           commit-message: "Add vulnerability SLA exception"
-          title: "Add vulnerability SLA exception"
-          body: "Adds a structured Periapsis vulnerability exception. Review required before merge."
-          branch: "periapsis/vulnerability-exception-request"
+          title: "Add vulnerability SLA exception (${{ inputs.exceptionType }}${{ inputs.alertNumber && format(' #{0}', inputs.alertNumber) || '' }})"
+          body: |
+            Adds a structured Periapsis vulnerability exception. Review required before merge.
+
+            - Type: ${{ inputs.exceptionType }}
+            - Alert: ${{ inputs.alertNumber || 'n/a' }}
+            - Severities: ${{ inputs.severities }}
+            - Adjusted severity: ${{ inputs.adjustedSeverity || 'n/a' }}
+            - Accepted until: ${{ inputs.acceptedUntil }}
+            - Evidence: ${{ inputs.evidenceRef }}
+
+            Reason: ${{ inputs.reason }}
+          branch: "periapsis/vulnerability-exception-${{ github.run_id }}"

package/.github/workflows/periapsis-vulnerability-triage.yml

@@ -0,0 +1,111 @@
+name: Periapsis Vulnerability Triage
+
+on:
+  schedule:
+    - cron: "30 14 * * *"
+  workflow_dispatch:
+    inputs:
+      alertNumber:
+        description: "Dependabot alert number (leave empty to triage pending alerts per policy.triage.automation)"
+        required: false
+      mode:
+        description: "Use the policy's triage.mode, or override it for this run"
+        required: false
+        type: choice
+        default: policy
+        options: [policy, recommend, apply]
+
+permissions:
+  contents: write # commit applied adjustments for the exception PR
+  pull-requests: write # open the exception PR
+  vulnerability-alerts: read
+  actions: write # restore the triage ledger artifact; single-alert apply dispatches the exception request
+
+# The ledger is read at the start and written at the end of each run; never run two at once.
+concurrency:
+  group: periapsis-vulnerability-triage
+  cancel-in-progress: false
+
+jobs:
+  periapsis-vulnerability-triage:
+    runs-on: ubuntu-latest
+    env:
+      SMTP_CONFIGURED: ${{ secrets.PERIAPSIS_SMTP_HOST != '' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install periapsis
+        run: npm install -g periapsis
+      - name: Restore triage ledger
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          ID=$(gh api "repos/$GITHUB_REPOSITORY/actions/artifacts?name=periapsis-triage-ledger&per_page=1" --jq '.artifacts[0] | select(.expired == false) | .id' || true)
+          if [ -n "$ID" ]; then
+            mkdir -p policy/triage
+            gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$ID/zip" > "$RUNNER_TEMP/ledger.zip"
+            unzip -o "$RUNNER_TEMP/ledger.zip" -d policy/triage
+            echo "Restored triage ledger from artifact $ID"
+          else
+            echo "No previous triage ledger found; starting fresh"
+          fi
+      - name: Triage vulnerability alerts
+        id: triage
+        run: |
+          ARGS=()
+          if [ -n "$ALERT_NUMBER" ]; then ARGS+=(--alert "$ALERT_NUMBER"); else ARGS+=(--pending); fi
+          if [ -n "$MODE" ] && [ "$MODE" != "policy" ]; then ARGS+=(--mode "$MODE"); fi
+          periapsis vulnerability triage "${ARGS[@]}"
+        env:
+          ALERT_NUMBER: ${{ inputs.alertNumber }}
+          MODE: ${{ inputs.mode }}
+          GITHUB_TOKEN: ${{ secrets.PERIAPSIS_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          PERIAPSIS_LLM_PROVIDER: ${{ vars.PERIAPSIS_LLM_PROVIDER }}
+          PERIAPSIS_LLM_MODEL: ${{ vars.PERIAPSIS_LLM_MODEL }}
+          PERIAPSIS_LLM_API_KEY: ${{ secrets.PERIAPSIS_LLM_API_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          PERIAPSIS_SLACK_WEBHOOK: ${{ secrets.PERIAPSIS_SLACK_WEBHOOK }}
+      - name: Save triage ledger
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: periapsis-triage-ledger
+          path: policy/triage/ledger.json
+          if-no-files-found: ignore
+          retention-days: 90
+      - name: Upload triage reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: vulnerability-triage-${{ github.run_id }}
+          path: |
+            policy/triage/
+            !policy/triage/ledger.json
+          if-no-files-found: ignore
+          retention-days: 90
+      - name: Validate applied adjustments
+        if: steps.triage.outputs.applied != '' && steps.triage.outputs.applied != '0'
+        run: periapsis vulnerability validate
+      - name: Open exception PR for applied adjustments
+        if: steps.triage.outputs.applied != '' && steps.triage.outputs.applied != '0'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          add-paths: policy/vulnerability-exceptions.json
+          commit-message: "Add Periapsis triage severity adjustments"
+          title: "Periapsis triage: ${{ steps.triage.outputs.applied }} severity adjustment(s)"
+          body-path: policy/triage/digest.md
+          branch: "periapsis/triage-adjustments-${{ github.run_id }}"
+      - name: Send triage email
+        if: always() && steps.triage.outputs.email == 'true' && env.SMTP_CONFIGURED == 'true'
+        uses: dawidd6/action-send-mail@v3
+        with:
+          server_address: ${{ secrets.PERIAPSIS_SMTP_HOST }}
+          server_port: ${{ secrets.PERIAPSIS_SMTP_PORT || 587 }}
+          username: ${{ secrets.PERIAPSIS_SMTP_USER }}
+          password: ${{ secrets.PERIAPSIS_SMTP_PASSWORD }}
+          subject: ${{ steps.triage.outputs.subject }}
+          to: ${{ secrets.PERIAPSIS_EMAIL_TO }}
+          from: ${{ secrets.PERIAPSIS_EMAIL_FROM || secrets.PERIAPSIS_SMTP_USER }}
+          body: file://${{ steps.triage.outputs.report }}
+          convert_markdown: true

package/README.md

@@ -49,6 +49,10 @@ Includes:
 
 ## 📦 Installation
 
+Testronaut 2.x requires **Node.js 20 or newer**. This is a breaking change from
+Testronaut 1.x because the bundled Playwright runtime no longer supports Node 18.
+Check your runtime with `node --version` before upgrading.
+
 **Global install** (recommended — use `testronaut` directly):
 ```bash
 npm install -g testronaut

package/TODO.md

@@ -9,6 +9,10 @@
 - [ ] Treat `--json` output as a stable automation contract with documented schemas and tests for every supported command.
 - [ ] If authentication ever moves outside project config, continue reading existing `sessionToken` values and provide an opt-in migration path before deprecating legacy storage.
 
+## Browser Automation Follow-Ups
+
+- [ ] Fix `click_text` so it prioritizes exact-text actionable elements (`button`, `a`, and elements with interactive roles) instead of clicking the first container whose descendant text includes the target. Define an explicit fallback for partial matches and add regression tests covering nested containers, duplicate labels, hidden elements, and the Add, Logout, and Report failures observed in the examples run.
+
 ## Session and Reporting Follow-Ups
 
 - [ ] Evaluate a true shared browser-context mode for suites that require session storage or in-memory application state; define page reset, crash recovery, and concurrency behavior first.

package/bin/cli.js

@@ -76,6 +76,18 @@ const CLI_VERSION = JSON.parse(
 
 const DEFAULT_API_BASE = 'https://api.testronaut.app';
 const DEV_API_BASE = 'https://staging.api.testronaut.app';
+const PLAYWRIGHT_INSTALL_PROMPT = {
+  type: 'confirm',
+  name: 'doPw',
+  message: 'Install Playwright browsers now?',
+  default: true,
+};
+const API_KEY_PROMPT = {
+  type: 'password',
+  name: 'apiKey',
+  message: 'Enter your API key:',
+  mask: '*',
+};
 
 let args = process.argv.slice(2);
 
@@ -138,6 +150,14 @@ function isDirectInvocation(argv1 = process.argv[1], moduleUrl = import.meta.url
   }
 }
 
+function isPromptExitError(error) {
+  return error instanceof Error && error.name === 'ExitPromptError';
+}
+
+function formatCliError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 const cliName = detectCliName();
 
 // Look for --dev / --developer / --developer-mode / --staging
@@ -367,6 +387,8 @@ export const __test__ = {
   parseOptimizationArgs,
   detectCliName,
   isDirectInvocation,
+  isPromptExitError,
+  formatCliError,
   resolveMissionPath,
   collectReportScreenshotNames,
   collectReportScreenshotPaths,
@@ -374,6 +396,8 @@ export const __test__ = {
   closestMissionMatch,
   resolveReportFile,
   buildEffectiveConfig,
+  PLAYWRIGHT_INSTALL_PROMPT,
+  API_KEY_PROMPT,
 };
 
 function resolveReportDir(config = {}, cwd = process.cwd()) {
@@ -893,9 +917,7 @@ if (args.includes('--init')) {
   await createWelcomeMission();
 
   const { default: inquirer } = await import('inquirer');
-  const { doPw } = await inquirer.prompt([
-    { type: 'confirm', name: 'doPw', message: 'Install Playwright browsers now?', default: true }
-  ]);
+  const { doPw } = await inquirer.prompt([PLAYWRIGHT_INSTALL_PROMPT]);
 
   if (doPw) {
     // ensure @playwright/test exists so the installer can pin to its version
@@ -1438,14 +1460,7 @@ async function handleLogin() {
 
   // If API key is not provided, prompt the user for it
   if (!apiKey) {
-    const responses = await inquirer.prompt([
-      {
-        type: 'password',
-        name: 'apiKey',
-        message: 'Enter your API key:',
-        mask: '*' 
-      }
-    ]);
+    const responses = await inquirer.prompt([API_KEY_PROMPT]);
     apiKey = responses.apiKey;
   }
 
@@ -1487,7 +1502,7 @@ async function handleLogin() {
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf8');
     console.log('✅ Login successful! Session token saved to testronaut-config.json.');
   } catch (error) {
-    console.error('❌ Error during login:', error);
+    console.error('❌ Error during login:', formatCliError(error));
     process.exit(1);
   }
 }
@@ -1845,5 +1860,14 @@ async function serveLatestReport() {
 }
 
 if (isDirectInvocation()) {
-  await main();
+  try {
+    await main();
+  } catch (error) {
+    if (isPromptExitError(error)) {
+      console.error('Prompt cancelled.');
+      process.exitCode = 130;
+    } else {
+      throw error;
+    }
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testronaut",
-  "version": "1.12.2",
+  "version": "2.0.1",
   "main": "./runner/testronaut.js",
   "bin": {
     "testronaut": "bin/cli.js"
@@ -11,6 +11,9 @@
     "./runner/testronaut": "./runner/testronaut.js"
   },
   "type": "module",
+  "engines": {
+    "node": ">=20.17.0"
+  },
   "scripts": {
     "benchmark:optimization": "node ./experiments/optimizationBenchmark.js",
     "benchmark:cross-provider": "node ./experiments/crossProviderBenchmark.js",
@@ -34,11 +37,11 @@
     "cheerio": "^1.1.0",
     "dotenv": "^17.2.0",
     "fast-glob": "^3.3.3",
-    "inquirer": "^12.9.1",
+    "inquirer": "^14.2.2",
     "jiti": "^2.7.0",
     "node-fetch": "^3.3.2",
     "openai": "^6.39.0",
-    "playwright": "^1.54.1",
+    "playwright": "^1.63.0",
     "prompts": "^2.4.2"
   },
   "keywords": [
@@ -56,7 +59,7 @@
   ],
   "devDependencies": {
     "@types/node": "^26.5.0",
-    "periapsis": "^2.0.1",
+    "periapsis": "^2.1.2",
     "vitest": "^4.1.11"
   },
   "homepage": "https://testronaut.app"

package/policy/vulnerability-policy.json

@@ -29,5 +29,35 @@
     "allowPackageScope": true,
     "allowRepoWideScope": true,
     "allowOrgWideScope": false
+  },
+  "triage": {
+    "mode": "recommend",
+    "notify": [
+      "slack",
+      "email"
+    ],
+    "apply": {
+      "minimumConfidence": "high",
+      "minimumConfidenceSingleStep": "medium",
+      "allowedReachability": [
+        "not_reachable",
+        "potentially_reachable"
+      ],
+      "approvedBy": [
+        "periapsis-triage"
+      ],
+      "workflow": "periapsis-vulnerability-exception-request.yml",
+      "ref": null
+    },
+    "automation": {
+      "minimumSeverity": "high",
+      "scopes": [
+        "runtime",
+        "development"
+      ],
+      "maxTriagesPerRun": 10,
+      "retriageAfterDays": 30,
+      "skipAlerts": []
+    }
   }
-}
+}

package/tests/binTests/cli.helpers.test.js

@@ -22,6 +22,40 @@ describe('cli helpers', () => {
     expect(__test__.DEFAULT_API_BASE).toBe('https://api.testronaut.app');
   });
 
+  it('keeps interactive prompt contracts compatible with Inquirer 14', () => {
+    expect(__test__.PLAYWRIGHT_INSTALL_PROMPT).toEqual({
+      type: 'confirm',
+      name: 'doPw',
+      message: 'Install Playwright browsers now?',
+      default: true,
+    });
+    expect(__test__.API_KEY_PROMPT).toEqual({
+      type: 'password',
+      name: 'apiKey',
+      message: 'Enter your API key:',
+      mask: '*',
+    });
+  });
+
+  it('recognizes Inquirer prompt cancellation without swallowing other failures', () => {
+    const cancelled = new Error('User force closed the prompt with SIGINT');
+    cancelled.name = 'ExitPromptError';
+
+    expect(__test__.isPromptExitError(cancelled)).toBe(true);
+    expect(__test__.isPromptExitError(new Error('network failed'))).toBe(false);
+    expect(__test__.isPromptExitError({ name: 'ExitPromptError' })).toBe(false);
+  });
+
+  it('formats CLI errors without printing stack traces', () => {
+    const error = new Error('login 401 Unauthorized: {"error":"Invalid API key"}');
+
+    expect(__test__.formatCliError(error)).toBe(
+      'login 401 Unauthorized: {"error":"Invalid API key"}',
+    );
+    expect(__test__.formatCliError(error)).not.toContain(' at ');
+    expect(__test__.formatCliError('request failed')).toBe('request failed');
+  });
+
   it('guessMimeType returns expected types', () => {
     const { guessMimeType } = __test__;
     expect(guessMimeType('file.html')).toContain('text/html');

package/tests/dependencyCompatibility.test.js

@@ -0,0 +1,31 @@
+import fs from 'fs';
+import path from 'path';
+import { describe, expect, it } from 'vitest';
+
+const root = path.resolve(import.meta.dirname, '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
+
+describe('runtime dependency compatibility', () => {
+  it('records the Node runtime required by the installed Playwright version', () => {
+    const playwright = lock.packages['node_modules/playwright'];
+    expect(playwright.engines.node).toBe('>=20');
+  });
+
+  it('keeps the manifest, lockfile root, and installed Playwright versions aligned', () => {
+    expect(pkg.dependencies.playwright).toBe('^1.63.0');
+    expect(lock.packages[''].dependencies.playwright).toBe(pkg.dependencies.playwright);
+    expect(lock.packages['node_modules/playwright'].version).toBe('1.63.0');
+    expect(lock.packages['node_modules/playwright-core'].version).toBe('1.63.0');
+  });
+
+  it('declares the minimum Node runtime required by Inquirer 14', () => {
+    const inquirer = lock.packages['node_modules/inquirer'];
+    expect(pkg.engines.node).toBe('>=20.17.0');
+    expect(lock.packages[''].engines.node).toBe(pkg.engines.node);
+    expect(pkg.dependencies.inquirer).toBe('^14.2.2');
+    expect(lock.packages[''].dependencies.inquirer).toBe(pkg.dependencies.inquirer);
+    expect(inquirer.version).toBe('14.2.2');
+    expect(inquirer.engines.node).toContain('^20.17.0');
+  });
+});

package/tests/toolsTests/playwrightSetup.test.js

@@ -0,0 +1,69 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { ensureBrowsers } from '../../tools/playwrightSetup.js';
+
+const tempDirs = [];
+
+afterEach(() => {
+  delete process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD;
+  while (tempDirs.length) fs.rmSync(tempDirs.pop(), { recursive: true, force: true });
+});
+
+function tempProject(lockfile) {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'testronaut-playwright-'));
+  tempDirs.push(cwd);
+  if (lockfile) fs.writeFileSync(path.join(cwd, lockfile), '');
+  return cwd;
+}
+
+describe('Playwright browser setup', () => {
+  it('installs the browser matching the locally resolved Playwright version', async () => {
+    const runCommand = vi.fn().mockResolvedValue(undefined);
+    const cliPath = '/project/node_modules/playwright/cli.js';
+
+    await ensureBrowsers(
+      { browser: 'chromium', withDeps: true },
+      { getInstallation: () => ({ version: '1.63.0', cliPath }), runCommand, cwd: tempProject('package-lock.json') },
+    );
+
+    expect(runCommand).toHaveBeenCalledOnce();
+    expect(runCommand).toHaveBeenCalledWith(
+      process.execPath,
+      [cliPath, 'install', 'chromium', '--with-deps'],
+      { PLAYWRIGHT_BROWSERS_PATH: '0' },
+    );
+  });
+
+  it.each([
+    ['pnpm-lock.yaml', 'pnpm', ['exec', 'playwright', 'install', 'chromium']],
+    ['yarn.lock', 'yarn', ['playwright', 'install', 'chromium']],
+    ['bun.lockb', 'bunx', ['playwright', 'install', 'chromium']],
+    ['package-lock.json', 'npm', ['exec', '--yes', '--', 'playwright', 'install', 'chromium']],
+  ])('uses the project package manager fallback for %s', async (lockfile, command, args) => {
+    const runCommand = vi.fn()
+      .mockRejectedValueOnce(new Error('npx unavailable'))
+      .mockResolvedValueOnce(undefined);
+
+    await ensureBrowsers(
+      { browser: 'chromium', withDeps: false },
+      {
+        getInstallation: () => ({ version: '1.63.0', cliPath: '/project/node_modules/playwright/cli.js' }),
+        runCommand,
+        cwd: tempProject(lockfile),
+      },
+    );
+
+    expect(runCommand).toHaveBeenNthCalledWith(2, command, args, { PLAYWRIGHT_BROWSERS_PATH: '0' });
+  });
+
+  it('does not invoke an installer when browser downloads are disabled', async () => {
+    process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = '1';
+    const runCommand = vi.fn();
+
+    await ensureBrowsers({}, { getInstallation: vi.fn(), runCommand, cwd: tempProject() });
+
+    expect(runCommand).not.toHaveBeenCalled();
+  });
+});

package/tools/playwrightSetup.js

@@ -1,23 +1,22 @@
 import { createRequire } from 'module';
 import fs from 'fs';
 import path from 'path';
-import { promisify } from 'util';
-import { exec as execCb } from 'child_process';
-
-const exec = promisify(execCb);
+import { spawn } from 'child_process';
 
 // Resolve from the **user project** (cwd)
 const req = createRequire(path.join(process.cwd(), 'noop.js'));
 
 // Prefer 'playwright' → '@playwright/test' → 'playwright-core' from the USER PROJECT (cwd)
-function getPlaywrightVersion() {
+function getPlaywrightInstallation() {
   console.log('🔍 Detecting installed Playwright version (from project)…');
   const tryPkg = (name) => {
     try {
       const p = req.resolve(`${name}/package.json`);
-      const v = JSON.parse(fs.readFileSync(p, 'utf8')).version;
-      console.log(`   • found ${name}@${v} → ${p}`);
-      return v;
+      const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
+      const bin = typeof pkg.bin === 'string' ? pkg.bin : Object.values(pkg.bin || {})[0];
+      const cliPath = bin ? path.resolve(path.dirname(p), bin) : null;
+      console.log(`   • found ${name}@${pkg.version} → ${p}`);
+      return { version: pkg.version, cliPath };
     } catch {
       return null;
     }
@@ -26,7 +25,7 @@ function getPlaywrightVersion() {
     tryPkg('playwright') ||
     tryPkg('@playwright/test') ||
     tryPkg('playwright-core') ||
-    'latest'
+    { version: 'latest', cliPath: null }
   );
 }
 
@@ -38,33 +37,46 @@ function pkgManagerForCwd(cwd = process.cwd()) {
   return 'npm';
 }
 
-async function run(cmd, extraEnv = {}) {
-  console.log(`\n> ${cmd}`);
-  await exec(cmd, { stdio: 'inherit', env: { ...process.env, ...extraEnv } });
+async function run(command, args, extraEnv = {}) {
+  console.log(`\n> ${[command, ...args].join(' ')}`);
+  await new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: 'inherit',
+      env: { ...process.env, ...extraEnv },
+    });
+    child.once('error', reject);
+    child.once('exit', (code, signal) => {
+      if (code === 0) resolve();
+      else reject(new Error(`${command} exited with ${signal || `code ${code}`}`));
+    });
+  });
 }
 
-export async function ensureBrowsers({ browser = 'chromium', withDeps = true } = {}) {
+export async function ensureBrowsers(
+  { browser = 'chromium', withDeps = true } = {},
+  { getInstallation = getPlaywrightInstallation, runCommand = run, cwd = process.cwd() } = {},
+) {
   if (process.env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD === '1') return;
 
-  const version = getPlaywrightVersion();
-  const withDepsFlag = withDeps ? ' --with-deps' : '';
+  const installation = getInstallation();
+  const installArgs = ['install', browser, ...(withDeps ? ['--with-deps'] : [])];
   const localCacheEnv = { PLAYWRIGHT_BROWSERS_PATH: '0' }; // project-local cache
 
-  const npxCmd = `npx -y playwright@${version} install ${browser}${withDepsFlag}`;
   try {
-    await run(npxCmd, localCacheEnv);
+    if (!installation.cliPath) throw new Error('No local Playwright CLI was resolved');
+    // Execute the CLI beside the package that will launch the browser. With
+    // PLAYWRIGHT_BROWSERS_PATH=0, running an npx-temporary CLI downloads into
+    // the temporary package instead of this project and leaves launch broken.
+    await runCommand(process.execPath, [installation.cliPath, ...installArgs], localCacheEnv);
   } catch {
-    const pm =
-      fs.existsSync(path.join(process.cwd(), 'pnpm-lock.yaml')) ? 'pnpm' :
-      fs.existsSync(path.join(process.cwd(), 'yarn.lock')) ? 'yarn' :
-      fs.existsSync(path.join(process.cwd(), 'bun.lockb')) ? 'bun' : 'npm';
+    const pm = pkgManagerForCwd(cwd);
 
-    const fallback =
-      pm === 'pnpm' ? `pnpm exec playwright install ${browser}${withDepsFlag}` :
-      pm === 'yarn' ? `yarn playwright install ${browser}${withDepsFlag}` :
-      pm === 'bun'  ? `bunx playwright install ${browser}${withDepsFlag}` :
-                      `npm exec --yes playwright@${version} install ${browser}${withDepsFlag}`;
+    const [command, args] =
+      pm === 'pnpm' ? ['pnpm', ['exec', 'playwright', ...installArgs]] :
+      pm === 'yarn' ? ['yarn', ['playwright', ...installArgs]] :
+      pm === 'bun'  ? ['bunx', ['playwright', ...installArgs]] :
+                      ['npm', ['exec', '--yes', '--', 'playwright', ...installArgs]];
 
-    await run(fallback, localCacheEnv);
+    await runCommand(command, args, localCacheEnv);
   }
 }