fix: preserve routed security across browser sessions

Author: chubes4

packages/runtime-playground/src/browser-actions-runner.ts

@@ -134,7 +134,7 @@ export async function runBrowserActionsCommand({
   const browser = session?.browser ?? await launchChromiumBrowser()
   const topology = browserPreviewTopology(args, runtimeSpec, server.serverUrl, server.previewProxyDiagnostics?.targetOrigin)
   const { preview, networkPolicy } = topology
-  const routeTracker = createBrowserPreviewRouteTracker()
+  const routeTracker = session?.routeTracker ?? createBrowserPreviewRouteTracker()
   let requestedUrl = initialUrl ? topology.resolveUrl(initialUrl) : preview.effectiveOrigin
   let finalUrl = requestedUrl
   let htmlSha256: string | undefined
@@ -967,6 +967,7 @@ export async function runBrowserScenarioCommand({
   let pendingError: Error | undefined
   let scenarioSession: PlaywrightBrowserEnvironmentSession | undefined
   let scenarioBrowser: Awaited<ReturnType<typeof launchChromiumBrowser>> | undefined
+  let scenarioRouteTracker: ReturnType<typeof createBrowserPreviewRouteTracker> | undefined
 
   try {
     if (runPlan.probe && runPlan.actions) {
@@ -980,8 +981,9 @@ export async function runBrowserScenarioCommand({
         ...(runPlan.actions.storageStateImport ? { contextOptions: { storageState: runPlan.actions.storageStateImport.storageState } } : {}),
       })
       const topology = browserPreviewTopology(args, runtimeSpec, server.serverUrl)
-      if (browserPreviewNeedsContextRouting(topology.networkPolicy)) await routeBrowserPreviewContextNetwork(runtime.context, topology.networkPolicy, topology.preview.effectiveOrigin)
-      scenarioSession = { browser, requested: requestedEnvironment, resolved, runtime }
+      const routeTracker = scenarioRouteTracker = createBrowserPreviewRouteTracker()
+      if (browserPreviewNeedsContextRouting(topology.networkPolicy)) await routeBrowserPreviewContextNetwork(runtime.context, topology.networkPolicy, topology.origins.localProxyOrigin, routeTracker)
+      scenarioSession = { browser, requested: requestedEnvironment, resolved, routeTracker, runtime }
     }
 
     if (runPlan.probe) {
@@ -1006,8 +1008,15 @@ export async function runBrowserScenarioCommand({
       }
     }
   } finally {
-    await scenarioSession?.runtime.close().catch(() => undefined)
-    await scenarioBrowser?.close().catch(() => undefined)
+    if (scenarioSession && scenarioBrowser && scenarioRouteTracker) {
+      const activeSession = scenarioSession
+      const activeBrowser = scenarioBrowser
+      const cleanupBrowser = { close: async () => { await activeSession.runtime.close(); await activeBrowser.close() } }
+      const routeErrors = await closeBrowserAndDrainPreviewRoutes(cleanupBrowser, scenarioRouteTracker)
+      pendingError ??= routeErrors[0]
+    } else {
+      await scenarioBrowser?.close().catch(() => undefined)
+    }
   }
 
   const primaryArtifact = actionsResult?.artifact ?? probeResult?.artifact

packages/runtime-playground/src/browser-environment-matrix.ts

@@ -13,6 +13,7 @@ import {
 } from "@automattic/wp-codebox-core"
 import type { Browser, BrowserContext, BrowserContextOptions, Page } from "playwright"
 import type { BrowserArtifactSummary } from "./browser-artifacts.js"
+import type { BrowserPreviewRouteTracker } from "./browser-preview-routing.js"
 
 export const PLAYWRIGHT_BROWSER_ENVIRONMENT_CAPABILITIES = [
   "browser.environment.viewport",
@@ -75,6 +76,7 @@ export interface PlaywrightBrowserEnvironmentSession {
   browser: Browser
   requested: BrowserEnvironment
   resolved: ResolvedBrowserEnvironment
+  routeTracker?: BrowserPreviewRouteTracker
   runtime: PlaywrightBrowserEnvironmentRuntime
 }
 

packages/runtime-playground/src/browser-probe-runner.ts

@@ -248,7 +248,7 @@ export async function runSingleBrowserProbeCommand({
   const prePageScriptMetadata = prePageScript ? browserProbeScriptMetadata(prePageScript) : undefined
   const topology = browserPreviewTopology(args, runtimeSpec, server.serverUrl, server.previewProxyDiagnostics?.targetOrigin)
   const { preview, networkPolicy } = topology
-  const routeTracker = createBrowserPreviewRouteTracker()
+  const routeTracker = session?.routeTracker ?? createBrowserPreviewRouteTracker()
   const targetUrl = topology.resolveUrl(runPlan.url)
   const artifactSession = new BrowserArtifactSession(artifactRoot, browserFilesDirectory, { source: command, operation: "browser-probe" })
 
@@ -513,17 +513,8 @@ export async function runSingleBrowserProbeCommand({
     } catch (error) {
       errors.push(serializeBrowserError("probe-error", error))
     }
-    try {
-      await geolocationPermissionCleanup?.()
-    } catch (error) {
-      const cleanupError = redactError(error, { redactAllUrlQueryValues: true, redactUrlHash: true, redactQueryAssignments: true })
-      if (!pendingError) {
-        pendingError = cleanupError
-        progress.fail("probe-error", cleanupError)
-      }
-      errors.push(serializeBrowserError("probe-error", error))
-    }
-    for (const routeError of await closeBrowserAndDrainPreviewRoutes(browser, routeTracker)) {
+    const cleanupBrowser = session ? { close: async () => {} } : { close: async () => { await environmentRuntime?.close(); await browser.close() } }
+    for (const routeError of await closeBrowserAndDrainPreviewRoutes(cleanupBrowser, routeTracker)) {
       const browserCloseFailed = routeError.message.includes("operation=browser-close")
       if (!pendingError && (browserCloseFailed || runPlan.routeHostDrain === "required")) {
         pendingError = routeError

tests/browser-routed-command-security.test.ts

@@ -97,7 +97,9 @@ test("real browser commands sanitize console, artifacts, stdout, and failure std
           url: `${serverUrl}/editor?token=${TOKEN}`,
           actors: [{ name: "author", userSession: "author-session" }],
           actions: [],
+          browserArgs: [],
           captures: ["steps", "network", "console"],
+          environment: {},
         },
         server,
       })
@@ -144,7 +146,9 @@ test("real browser commands sanitize console, artifacts, stdout, and failure std
         url: `${serverUrl}/editor?token=${TOKEN}`,
         actors: [{ name: "author", userSession: "author-session" }],
         actions: [{ id: "missing-click", actor: "author", step: { kind: "click", selector: "#missing" } }],
+        browserArgs: [],
         captures: ["errors"],
+        environment: {},
         stepTimeoutMs: 250,
       },
       server,