fix(mcp): ask for a cookie domain when the page has no host by pavelfeldman · Pull Request #43318 · microsoft/playwright

Pavel Feldman (pavelfeldman) · 2026-10-12T22:25:09Z

Without a domain, browser_cookie_set (and playwright-cli cookie-set) uses the current page's hostname. On about:blank or a data: page that hostname is empty, so addCookies failed with the internal assertion Cookie should have a url or a domain/path pair.

The tool now reports Cannot infer the cookie domain from the page URL "about:blank", specify "domain".. It also parses the page URL only when no domain is given.

Test: the existing browser_cookie_set and browser_cookie_get test now starts by setting a cookie on the blank page without domain and expects that error. It fails without the fix and passes on chrome, chromium, firefox and webkit.

Fixes: #43309

github-actions · 2026-10-12T23:12:28Z

Hi, I'm the Playwright bot and I took a first look at the CI failure.

🟢 The failure is a confirmed pre-existing flake

mcp/idle-timeout.spec.ts:19 has failed on unrelated commits, while this PR only changes cookie-domain validation.

Details

This PR changes cookies.ts and cookies.spec.ts. The failed test exercises browser shutdown and relaunch after an idle timeout; it failed on Windows Firefox because the relaunched browser closed during browser_navigate.

Pre-existing flake / infra

[firefox] › mcp/idle-timeout.spec.ts:19 › closes the browser after the idle timeout and relaunches it on the next call — the same (project, file, test) failed in 5 of 32 recent Windows Firefox runs and passed in the other 27. The failures include three main runs on unrelated SHAs (05ffe822, 784dcea4, and 606f017a) and a run for chore(deps): bump futureware-tech/simulator-action from 5 to 6 in the github-actions group #43284. This PR does not change the idle-timeout or browser lifecycle paths.

_{Triaged by the Playwright bot - agent run}

Devin Rousso (dcrousso) · 2026-10-12T23:58:58Z

-    const url = new URL(tab.page.url());
+    const domain = params.domain || new URL(tab.page.url()).hostname;
+    if (!domain)
+      throw new Error(`Cannot infer the cookie domain from the page URL "${tab.page.url()}", specify "domain".`);


NIT: i feel like this error could be maybe slightly more readable? something like Cannot set cookies on a blank page without first navigating or providing a "domain" value?

github-actions · 2026-10-13T00:32:59Z

Test results for "MCP"

9204 passed, 1495 skipped

Merge workflow run.

## ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🙈 Redact runtime values in URLs** ([#1791](#1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](microsoft/playwright#43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](microsoft/playwright#42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](microsoft/playwright-cli#479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🎯 Use locators in your language** ([#1797](#1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](microsoft/playwright#43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](#1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](microsoft/playwright#43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](microsoft/playwright#43319)) ## 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](microsoft/playwright#43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](microsoft/playwright#42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](microsoft/playwright#43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](microsoft/playwright#43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](microsoft/playwright#43227), [microsoft/playwright#43244](microsoft/playwright#43244), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](microsoft/playwright#43316), [microsoft/playwright#43368](microsoft/playwright#43368), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](microsoft/playwright#43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](microsoft/playwright#43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](microsoft/playwright#43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](microsoft/playwright#43361), [microsoft/playwright#43577](microsoft/playwright#43577), [microsoft/playwright#43722](microsoft/playwright#43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](microsoft/playwright#43727)) ## 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

## ✨ Highlights - **👥 Use different signed-in users in one session** — `playwright-cli tab-new https://example.com --isolated-context=user-b` opens a tab with separate cookies and storage. Tabs with the same context name share their login state; different names stay isolated. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🎬 Smaller video recordings with less encoding CPU** — `playwright-cli video-start demo.webm` now records with VP9, keeping the same WebM output format. Stop and save the recording with `playwright-cli video-stop`. ([microsoft/playwright#43021](microsoft/playwright#43021)) - **📋 Keep console messages and requests across navigations** ([#479](#479)) — `playwright-cli console --all` and `playwright-cli requests --all` include retained entries from earlier navigations, so warnings and failed requests are not lost when checking a multi-page flow. Request numbers stay stable for `playwright-cli request 5`. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🔎 Keep common searches from flooding the agent's context** ([microsoft/playwright#42077](microsoft/playwright#42077)) — `playwright-cli find button --max-results=5` returns at most five matching items and reports the total match count. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🍪 Delete one site's cookie without signing out of others** ([microsoft/playwright#43310](microsoft/playwright#43310)) — `playwright-cli cookie-delete session_id --domain=example.com --path=/` removes only the cookie matching that name, domain and path, leaving same-named cookies elsewhere intact. ([microsoft/playwright#43319](microsoft/playwright#43319)) - **🔒 Redact session tokens in URLs printed in responses** ([microsoft/playwright-mcp#1791](microsoft/playwright-mcp#1791)) — add `"redactUrlParams": ["access_token", "code"]` to `.playwright/cli.config.json` to replace those query and fragment parameter values with `<redacted>` in command responses. ([microsoft/playwright#43258](microsoft/playwright#43258)) ## 🐛 Fixes - `fix(cli): do not force-kill the browser on close` — `playwright-cli close` lets Chrome shut down normally, preventing temporary app-clone folders from accumulating on macOS. ([#475](#475), [microsoft/playwright#43229](microsoft/playwright#43229)) - `fix(cli): respect npm registry config in update check` — update checks honor npm's registry, scoped registry, proxy and authentication settings instead of contacting the public registry directly when a custom registry is configured. ([#478](#478), [#484](#484)) - `fix(cli): report run-code route handler exception once and verbatim` — asynchronous route callback errors return their original message without duplicated errors or an extra `Error:` prefix. ([#476](#476), [microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(chromium): do not hang on pages without a renderer when connecting over CDP` — `attach --cdp` handles discarded or crashed tabs without wedging every command; a follow-up closes those tabs while preserving live ones. ([microsoft/playwright#41714](microsoft/playwright#41714), [microsoft/playwright#42936](microsoft/playwright#42936), [microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(chromium): report local frames of existing oopifs when connecting over CDP` — attaching to an already-loaded page discovers nested frames correctly instead of replacing the main document with a sandboxed iframe. ([microsoft/playwright#42955](microsoft/playwright#42955), [microsoft/playwright#43000](microsoft/playwright#43000)) - `fix(mcp): report invalid element targets and accept locators in any language` — action targets accept JavaScript, Python, Java and C# locators. Invalid targets explain the accepted forms, including how to pass a bare snapshot ref. ([microsoft/playwright-mcp#1797](microsoft/playwright-mcp#1797), [microsoft/playwright#43539](microsoft/playwright#43539)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `playwright-cli open 127.0.0.1:3000` uses HTTP, and bare external hosts with ports are normalized to HTTPS rather than mistaken for custom schemes. ([microsoft/playwright#43263](microsoft/playwright#43263), [microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): race browser_navigate_back and forward against modal states` — `go-back` and `go-forward` surface navigation dialogs immediately so they can be handled, rather than hanging until timeout. ([microsoft/playwright#43251](microsoft/playwright#43251), [microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): preserve origin filters when modifying request headers` — header-only `route` handlers no longer skip configured allowed/blocked-origin filters. ([microsoft/playwright#43630](microsoft/playwright#43630), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): pass custom headers to route.fulfill when mocking response` — mocked `route` responses retain supplied headers, including CORS and cache headers. ([microsoft/playwright#43245](microsoft/playwright#43245), [microsoft/playwright#43244](microsoft/playwright#43244)) - `fix(mcp): match browser_route header names case-insensitively` — request-header replacement and removal work consistently regardless of header-name casing. ([microsoft/playwright#43215](microsoft/playwright#43215), [microsoft/playwright#43227](microsoft/playwright#43227)) - `fix(mcp): match cookie list domain filter on domain boundaries` — `cookie-list --domain=example.com` includes that domain and its subdomains, not unrelated names such as `my-example.com`; matching ignores case and a leading dot. ([microsoft/playwright#43308](microsoft/playwright#43308), [microsoft/playwright#43316](microsoft/playwright#43316)) - `fix(mcp): do not match sibling paths in cookie-list path filter` — `cookie-list --path=/api` includes `/api` and paths under `/api/`, not `/apikeys`. ([microsoft/playwright#43366](microsoft/playwright#43366), [microsoft/playwright#43368](microsoft/playwright#43368)) - `fix(mcp): ask for a cookie domain when the page has no host` — `cookie-set` on `about:blank` or a data URL asks for `--domain` instead of returning an internal assertion error. ([microsoft/playwright#43309](microsoft/playwright#43309), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — authenticated proxy URLs supplied through `PLAYWRIGHT_MCP_PROXY_SERVER` retain their credentials instead of failing proxy authentication. ([microsoft/playwright#43048](microsoft/playwright#43048), [microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): accept Windows paths in browser_resume location` — `pause-at` accepts Windows source locations such as `C:\tests\example.spec.ts:42`. ([microsoft/playwright#43340](microsoft/playwright#43340), [microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(video): hide ffmpeg console windows on Windows` — `video-start` no longer opens a terminal window that steals focus during background recording. ([microsoft/playwright#43515](microsoft/playwright#43515), [microsoft/playwright#43575](microsoft/playwright#43575)) - `feat(cli): keep sockets in XDG_RUNTIME_DIR` — Unix CLI sessions and the dashboard prefer `$XDG_RUNTIME_DIR/playwright` over the shared temporary directory when it is usable. ([microsoft/playwright#43698](microsoft/playwright#43698), [microsoft/playwright#43732](microsoft/playwright#43732)) - `fix(tracing): do not store secrets in trace context options` — trace metadata no longer copies credential-bearing context options such as HTTP credentials, proxy credentials, extra headers and storage-state cookies. ([microsoft/playwright#38673](microsoft/playwright#38673), [microsoft/playwright#43220](microsoft/playwright#43220)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots show a loaded iframe's content and element refs even when its HTML contains fallback text. ([microsoft/playwright#43628](microsoft/playwright#43628), [microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-special text remains a string when snapshot output is parsed or reused. ([microsoft/playwright#43451](microsoft/playwright#43451), [microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude controls that cannot currently be used, and click/fill actions wait for targets to stop being inert rather than silently misfiring. ([microsoft/playwright#36938](microsoft/playwright#36938), [microsoft/playwright#42967](microsoft/playwright#42967), [microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(webmcp): handle Chromium tool API changes` — WebMCP tool discovery tolerates Chromium's null input schemas while preserving the existing tool shape. ([microsoft/playwright#43578](microsoft/playwright#43578)) ## 📦 Upgrading ```bash npm install -g @playwright/cli@0.1.23 ``` This release uses Playwright `1.65.0-alpha-2026-10-30`. Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | `0.0.83` → `0.0.84` | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.84?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@playwright%2fmcp/0.0.84?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@playwright%2fmcp/0.0.83/0.0.84?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.83/0.0.84?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.84`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.84) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.83...v0.0.84) #### ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](https://redirect.github.com/microsoft/playwright/pull/43087)) - **🙈 Redact runtime values in URLs** ([#1791](https://redirect.github.com/microsoft/playwright-mcp/issues/1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](https://redirect.github.com/microsoft/playwright/pull/43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](https://redirect.github.com/microsoft/playwright/pull/42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](https://redirect.github.com/microsoft/playwright-cli/issues/479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](https://redirect.github.com/microsoft/playwright/pull/43526)) - **🎯 Use locators in your language** ([#1797](https://redirect.github.com/microsoft/playwright-mcp/issues/1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](https://redirect.github.com/microsoft/playwright/pull/43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](https://redirect.github.com/microsoft/playwright-mcp/issues/1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](https://redirect.github.com/microsoft/playwright/pull/43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](https://redirect.github.com/microsoft/playwright/pull/43319)) #### 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](https://redirect.github.com/microsoft/playwright/pull/43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](https://redirect.github.com/microsoft/playwright/pull/42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](https://redirect.github.com/microsoft/playwright/pull/43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](https://redirect.github.com/microsoft/playwright/pull/43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](https://redirect.github.com/microsoft/playwright/pull/43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](https://redirect.github.com/microsoft/playwright/pull/43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](https://redirect.github.com/microsoft/playwright/pull/43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](https://redirect.github.com/microsoft/playwright/pull/43227), [microsoft/playwright#43244](https://redirect.github.com/microsoft/playwright/pull/43244), [microsoft/playwright#43637](https://redirect.github.com/microsoft/playwright/pull/43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](https://redirect.github.com/microsoft/playwright/pull/43316), [microsoft/playwright#43368](https://redirect.github.com/microsoft/playwright/pull/43368), [microsoft/playwright#43318](https://redirect.github.com/microsoft/playwright/pull/43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](https://redirect.github.com/microsoft/playwright/pull/43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](https://redirect.github.com/microsoft/playwright/pull/43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](https://redirect.github.com/microsoft/playwright/pull/43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](https://redirect.github.com/microsoft/playwright/pull/43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](https://redirect.github.com/microsoft/playwright/pull/43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](https://redirect.github.com/microsoft/playwright/pull/43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](https://redirect.github.com/microsoft/playwright/pull/43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](https://redirect.github.com/microsoft/playwright/pull/43361), [microsoft/playwright#43577](https://redirect.github.com/microsoft/playwright/pull/43577), [microsoft/playwright#43722](https://redirect.github.com/microsoft/playwright/pull/43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](https://redirect.github.com/microsoft/playwright/pull/43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](https://redirect.github.com/microsoft/playwright/pull/43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](https://redirect.github.com/microsoft/playwright/pull/43727)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/paulnsorensen/dotfiles).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Paul Sorensen <paulnsorensen@gmail.com>

## ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🙈 Redact runtime values in URLs** ([microsoft#1791](microsoft#1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](microsoft/playwright#43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](microsoft/playwright#42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](microsoft/playwright-cli#479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🎯 Use locators in your language** ([microsoft#1797](microsoft#1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](microsoft/playwright#43539)) - **📂 Skip unsupported workspace-root requests** ([microsoft#1798](microsoft#1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](microsoft/playwright#43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](microsoft/playwright#43319)) ## 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](microsoft/playwright#43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](microsoft/playwright#42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](microsoft/playwright#43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](microsoft/playwright#43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](microsoft/playwright#43227), [microsoft/playwright#43244](microsoft/playwright#43244), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](microsoft/playwright#43316), [microsoft/playwright#43368](microsoft/playwright#43368), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](microsoft/playwright#43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](microsoft/playwright#43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](microsoft/playwright#43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](microsoft/playwright#43361), [microsoft/playwright#43577](microsoft/playwright#43577), [microsoft/playwright#43722](microsoft/playwright#43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](microsoft/playwright#43727)) ## 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

fix(mcp): ask for a cookie domain when the page has no host

bb1df95

Fixes: #43309

Pavel Feldman (pavelfeldman) marked this pull request as ready for review October 12, 2026 22:44

This comment has been minimized.

Sign in to view

test: fold the blank page check into the existing test

5c899c6

Devin Rousso (dcrousso) approved these changes Oct 12, 2026

View reviewed changes

Pavel Feldman (pavelfeldman) merged commit a0d69f8 into main Oct 13, 2026
18 checks passed

Pavel Feldman (pavelfeldman) deleted the fix-43309 branch October 13, 2026 14:52

phusitkumsri1437-arch mentioned this pull request Oct 15, 2026

chore: mark v0.0.84 microsoft/playwright-mcp#1793

Closed

This was referenced Oct 31, 2026

chore: mark v0.0.84 microsoft/playwright-mcp#1814

Merged

chore: mark v0.1.23 microsoft/playwright-cli#494

Merged

renovate Bot mentioned this pull request Oct 31, 2026

feat(deps): update dev-env image toolchain group thaynes43/haynes-ops#4335

Open

1 task

Navigation Menu

Repository navigation

fix(mcp): ask for a cookie domain when the page has no host - #43318

fix(mcp): ask for a cookie domain when the page has no host#43318
Pavel Feldman (pavelfeldman) merged 2 commits into
mainfrom
fix-43309

Pavel Feldman (pavelfeldman) commented Oct 12, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 12, 2026

Uh oh!

Devin Rousso (dcrousso) Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Pavel Feldman (pavelfeldman) commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 12, 2026

🟢 The failure is a confirmed pre-existing flake

Uh oh!

Devin Rousso (dcrousso) Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 13, 2026

Test results for "MCP"

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Pavel Feldman (pavelfeldman) commented Oct 12, 2026 •

edited

Loading