Pin Power Pages Playwright MCP runtime

[Priyanshu Agrawal (priyanshu92)]

Summary

• pin the runtime-fetched @playwright/mcp package to reviewed version 0.0.78
• invoke npm's JavaScript npx entrypoint through Node with raw argv and shell: false
• preserve config paths containing spaces and shell metacharacters without shell quoting
• handle spawn failures and propagate child exit failures
• leave MCP root resolution unchanged

Testing

• POWER_PLATFORM_SKILLS_TELEMETRY_POWER_PAGES_OPTOUT=1 node --test plugins/power-pages/scripts/tests/
• exact-version Playwright MCP CLI smoke test through the approved package feed

[Copilot]

Pull request overview

Pins the Power Pages Playwright MCP bootstrap to a reviewed @playwright/mcp version and updates the launcher to invoke npx via Node (no shell) so config paths are passed as raw argv (including spaces/metacharacters), with improved error/exit propagation.

Changes:

• Pin runtime package selection to @playwright/mcp@0.0.78 and remove @latest usage.
• Launch MCP via node <npx-cli.js> ... with shell: false, preserving raw config paths.
• Expand tests to validate version pinning, argv behavior, Windows npx-cli.js resolution, and spawn/exit failure handling.

Show a summary per file

File	Description
plugins/power-pages/scripts/launch-playwright-mcp.js	Pins the MCP package version and changes process launch to node + npx-cli.js with shell: false, plus error/exit handling.
plugins/power-pages/scripts/tests/launch-playwright-mcp.test.js	Updates unit tests to assert exact version pinning, raw argv config paths, resolveNpxCli() behavior, and spawn/exit failure scenarios.
plugins/power-pages/scripts/tests/mcp-config.test.js	Adjusts bootstrap test strategy to intercept spawn and assert the pinned package/shell:false behavior during MCP server startup.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

Suppressed comments (1)

plugins/power-pages/scripts/launch-playwright-mcp.js:65

• launch() resolves npxCliPath via a default parameter (npxCliPath = resolveNpxCli()), so if npm isn’t present / npx-cli.js can’t be found, the error is thrown before launch() can use writeError/exitFn. That results in an uncaught exception + stack trace instead of the single-line failure output you added for spawn errors. Consider resolving inside the function body with try/catch and exiting cleanly (still allowing callers to pass npxCliPath explicitly).

function launch({
  browser = detectBrowser(),
  npxCliPath = resolveNpxCli(),
  spawnFn = spawn,
  exitFn = (code) => process.exit(code),
  writeError = (message) => process.stderr.write(message),
} = {}) {
  const child = spawnFn(process.execPath, [npxCliPath, ...buildMcpArgs(browser)], {

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

Suppressed comments (1)

plugins/power-pages/scripts/launch-playwright-mcp.js:23

• This still fetches and executes @playwright/mcp at runtime via npx-cli.js without a committed lockfile or other integrity record, which conflicts with the plugin’s secure-coding requirement that runtime packages have an exact version and a committed lock / equivalent integrity boundary (and calls out scripts/launch-playwright-mcp.js specifically). Pinning the version is a good step, but consider switching to a vendored/checked-in artifact or adding a verifiable integrity mechanism (e.g., checked-in tarball + hash verification) so installs don’t execute unverified installer output during a plugin run.

  // Marketplace installs copy only this plugin directory and do not run npm install,
  // so a lockfile would not materialize a local executable. Keep the runtime package
  // immutable, and disable lifecycle scripts while npx prepares the reviewed version.
  return [
    '--yes',

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite