Playwriter currently lets a connected agent create tabs and navigate them without a separate user approval. Because those tabs use the existing browser profile, the agent can access signed-in sites beyond the page the user initially enabled.
For example, I might enable Playwriter on a GitHub tab but want approval before the agent opens Gmail or an internal administration tool.
Could Playwriter support a configurable approval system enforced by the extension or relay?
An initial version could cover:
- New tabs: ask before creating each tab, allow creation for the session, or block creation.
- Navigation to another site: ask before navigating a controlled tab to a domain that has not been approved.
- Site permissions: maintain an allowlist and blocklist, with a way to review and revoke approvals.
- Remote control: show which browser access an approval grants to the remote client.
Approval prompts should show the requested action and destination. Ideally, users could choose Allow once, Allow for this session, or Deny.
The policy should apply consistently to CLI, MCP and remote-control clients using the extension. It should operate below the arbitrary JavaScript execute interface, so it does not depend on agent instructions or matching strings such as context.newPage(). Requests should remain blocked until approved, and closing or ignoring a prompt should leave them blocked.
This would provide useful controls over browser access. The documentation should explain the remaining limitations, particularly shared authentication state and what arbitrary JavaScript or CDP commands can still access. It should avoid presenting tab or domain approvals as a complete security sandbox.
Related:
- #122 addresses unnecessary tab creation, rather than user approval.
- #7 adds client authentication, rather than approval for individual browser actions.
Would this fit the project's direction? Starting with approval before new-tab creation would already address my immediate use case.
Activity
0No activity yet.