Harden Power Pages shell and URL handling

plugins/power-pages/.mcp.json

@@ -4,7 +4,7 @@
             "command": "node",
             "args": [
                 "-e",
-                "const fs=require('node:fs'); const path=require('node:path'); const root=process.env.PLUGIN_ROOT||process.env.CLAUDE_PLUGIN_ROOT||process.cwd(); const entry=path.resolve(root,'scripts','launch-playwright-mcp.js'); if(!fs.existsSync(entry)) throw new Error('Could not resolve Power Pages plugin root; set PLUGIN_ROOT or launch from the plugin root'); const mod=require(entry); if(!mod||typeof mod.launch!=='function') throw new Error('Power Pages Playwright MCP launcher did not export launch()'); mod.launch();"
+                "const fs=require('node:fs'); const path=require('node:path'); const fail=(message)=>{throw new Error('[Power Pages Playwright MCP] '+message);}; const declaredRoot=process.env.PLUGIN_ROOT||process.env.CLAUDE_PLUGIN_ROOT; if(!declaredRoot) fail('PLUGIN_ROOT or CLAUDE_PLUGIN_ROOT must be set; refusing to resolve the launcher from the current working directory.'); if(!path.isAbsolute(declaredRoot)) fail('Declared plugin root must be an absolute path: '+declaredRoot+'.'); let root; try{root=fs.realpathSync(declaredRoot);}catch(error){fail('Declared plugin root is invalid: '+declaredRoot+' ('+(error.code||error.message)+').');} let rootStat; try{rootStat=fs.statSync(root);}catch(error){fail('Could not inspect declared plugin root: '+root+' ('+(error.code||error.message)+').');} if(!rootStat.isDirectory()) fail('Declared plugin root is not a directory: '+declaredRoot+'.'); const candidate=path.resolve(root,'scripts','launch-playwright-mcp.js'); let entry; try{entry=fs.realpathSync(candidate);}catch(error){fail('Launcher was not found under the declared plugin root: '+candidate+'.');} const relative=path.relative(root,entry); if(relative==='..'||relative.startsWith('..'+path.sep)||path.isAbsolute(relative)) fail('Resolved launcher escapes the declared plugin root: '+entry+'.'); let entryStat; try{entryStat=fs.statSync(entry);}catch(error){fail('Could not inspect resolved launcher: '+entry+' ('+(error.code||error.message)+').');} if(!entryStat.isFile()) fail('Resolved launcher is not a file: '+entry+'.'); const mod=require(entry); if(!mod||typeof mod.launch!=='function') fail('Launcher did not export launch(): '+entry+'.'); mod.launch();"
             ]
         },
         "microsoft-learn": {

plugins/power-pages/README.md

@@ -436,6 +436,8 @@ The plugin ships with two MCP servers configured in `.mcp.json` — they start a
 | **playwright** | Headless browser automation for live previews and runtime tests |
 | **microsoft-learn** | Grounded search/fetch over official Microsoft Learn docs |
 
+The plugin host must provide an absolute `PLUGIN_ROOT` (GitHub Copilot) or `CLAUDE_PLUGIN_ROOT` (Claude Code). The Playwright bootstrap resolves its launcher only from that declared plugin root and never from the workspace working directory.
+
 ## Typical Workflow
 
 A common end-to-end workflow looks like this:
@@ -465,33 +467,20 @@ A common end-to-end workflow looks like this:
 
 Steps can be run independently — you don't need to follow this exact order. Each skill checks its own prerequisites and will tell you if something is missing. If something goes wrong, `/diagnose-deployment` pattern-matches deployment errors and `/report-issue` opens a pre-filled GitHub issue.
 
-## Running Without Interruption
-
-The plugin invokes multiple tools during a session. To reduce approval prompts:
-
-**Option 1 — Permission mode (recommended)**
-
-```jsonc
-// .claude/settings.json
-{
-  "defaultMode": "acceptEdits",
-  "permissions": {
-    "allow": [
-      "Bash(npm run *)",
-      "Bash(git *)",
-      "Bash(pac *)",
-      "Bash(az *)",
-      "Bash(node *)"
-    ]
-  }
-}
-```
+## Runtime approvals
 
-**Option 2 — Auto-accept all**
+Keep your AI host's runtime approval prompts enabled while using this plugin.
+Plugin scripts run on your workstation with the filesystem access and cloud sign-in state available to your user account.
+A script that invokes `pac` or `az` may therefore act on Power Platform environments, Dataverse data, and Azure tenants that you can access.
 
-```bash
-claude --dangerously-skip-permissions
-```
+Before approving a command, check the executable, script path, arguments, and target environment.
+Pay particular attention to commands that read or change project files, environment configuration, tenant resources, or business data.
+Do not grant blanket approval to command families such as `node`, `npm`, `git`, `pac`, or `az`.
+
+If your host supports command-specific allow rules, use them only for an exact plugin script path that you have inspected and expect to run.
+Keep approval prompts for commands whose arguments or environment variables select a project, environment, tenant, or data source.
+Permission features and rule syntax vary by host and version, so follow the documentation for your host.
+Suppressing an approval prompt does not sandbox a script, restrict the programs it can start, or guarantee that the command is safe.
 
 ## ALM prompts you may see
 

plugins/power-pages/scripts/launch-playwright-mcp.js

@@ -5,50 +5,95 @@
 // then falls back to Playwright's bundled Chromium.
 // Self-contained — no external dependencies required.
 
-const { spawn } = require('child_process');
+const { spawn } = require('node:child_process');
+const fs = require('node:fs');
 const path = require('path');
 const { detectBrowser } = require('./lib/detect-browser');
 
-function quoteShellArg(value, platform = process.platform) {
-  const argument = String(value);
-
-  if (platform === 'win32') {
-    if (argument.includes('"')) {
-      throw new Error('Cannot quote an argument containing double quotes for cmd.exe.');
-    }
-
-    return `"${argument}"`;
-  }
-
-  return `'${argument.replace(/'/g, "'\\''")}'`;
-}
+const PLAYWRIGHT_MCP_VERSION = '0.0.78';
+const PLAYWRIGHT_MCP_PACKAGE = `@playwright/mcp@${PLAYWRIGHT_MCP_VERSION}`;
 
 function buildMcpArgs(browser, {
   configPath = path.join(__dirname, 'playwright-mcp-fullscreen.config.json'),
-  platform = process.platform,
 } = {}) {
+  // Marketplace installs copy only this plugin directory and do not run npm install,
+  // so a lockfile would not materialize a local executable. Keep the runtime package
+  // immutable, and disable lifecycle scripts while npx prepares the reviewed version.
   return [
-    '-y',
-    '@playwright/mcp@latest',
+    '--yes',
+    '--ignore-scripts',
+    `--package=${PLAYWRIGHT_MCP_PACKAGE}`,
+    'playwright-mcp',
     '--browser',
     browser,
     '--config',
-    quoteShellArg(configPath, platform),
+    configPath,
+  ];
+}
+
+function resolveNpxCli({
+  execPath = process.execPath,
+  platform = process.platform,
+  existsSync = fs.existsSync,
+} = {}) {
+  // Windows exposes npx as a .cmd shim that cannot run with shell:false. Invoking
+  // npm's JavaScript entrypoint through Node preserves raw argv on every platform.
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  const nodeDir = pathApi.dirname(execPath);
+  const candidates = [
+    pathApi.resolve(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npx-cli.js'),
+    pathApi.join(nodeDir, 'node_modules', 'npm', 'bin', 'npx-cli.js'),
   ];
+  const match = candidates.find((candidate) => existsSync(candidate));
+
+  if (!match) {
+    throw new Error(
+      'Could not locate npm/bin/npx-cli.js beside the current Node installation. Install Node.js with npm before starting the Playwright MCP server.',
+    );
+  }
+
+  return match;
 }
 
-function launch({ browser = detectBrowser(), spawnFn = spawn, onExit = (code) => process.exit(code || 0) } = {}) {
-  const child = spawnFn('npx', buildMcpArgs(browser), {
+function launch({
+  browser = detectBrowser(),
+  npxCliPath,
+  resolveNpxCliFn = resolveNpxCli,
+  spawnFn = spawn,
+  exitFn = (code) => process.exit(code),
+  writeError = (message) => process.stderr.write(message),
+} = {}) {
+  let resolvedNpxCliPath = npxCliPath;
+  if (resolvedNpxCliPath === undefined) {
+    try {
+      resolvedNpxCliPath = resolveNpxCliFn();
+    } catch (error) {
+      writeError(`Failed to start Playwright MCP: ${error.message}\n`);
+      exitFn(1);
+      return null;
+    }
+  }
+
+  const child = spawnFn(process.execPath, [resolvedNpxCliPath, ...buildMcpArgs(browser)], {
     stdio: 'inherit',
-    shell: true,
+    shell: false,
   });
 
-  child.on('exit', onExit);
+  child.once('error', (error) => {
+    writeError(`Failed to start Playwright MCP: ${error.message}\n`);
+    exitFn(1);
+  });
+  child.once('exit', (code) => exitFn(code ?? 1));
   return child;
 }
 
 if (require.main === module) {
   launch();
 }
 
-module.exports = { buildMcpArgs, launch, quoteShellArg };
+module.exports = {
+  PLAYWRIGHT_MCP_PACKAGE,
+  buildMcpArgs,
+  launch,
+  resolveNpxCli,
+};

plugins/power-pages/scripts/lib/check-solution-installed.js

@@ -12,51 +12,15 @@ const helpers = require('./validation-helpers');
 const UNIQUE_NAME_RE = /^[A-Za-z0-9_]+$/;
 
 /**
- * Validates and normalizes a Dataverse environment URL before it is passed
- * to anything that interpolates it into a shell command (notably
- * helpers.getAuthToken, which calls `az account get-access-token --resource
- * "${url}"` via execSync). Returns the URL's `origin` only (scheme + host +
- * optional port) so path, query, fragment, and userinfo are all stripped.
- *
- * Throws on:
- *   - non-string / empty input
- *   - input that `new URL()` can't parse
- *   - non-https protocol (Dataverse refuses http and we don't want file: etc.)
- *   - URLs with embedded userinfo (https://user:pass@host) — credentials in
- *     URLs are a smell and can confuse downstream tooling
- *
- * The normalized origin is safe to interpolate into a shell command because
- * URL.origin only contains scheme, host, and port — characters that the
- * URL spec disallows from carrying shell metacharacters.
+ * Compatibility wrapper for existing callers. The shared validation helper
+ * owns the trust policy so token acquisition and authenticated requests use
+ * the same public and sovereign cloud endpoint allowlist.
  *
  * @param {unknown} envUrl
- * @returns {string} sanitized origin, e.g. "https://contoso.crm.dynamics.com"
- * @throws Error with a human-readable message on rejection
+ * @returns {string} validated Dataverse origin
  */
 function sanitizeEnvUrl(envUrl) {
-  if (typeof envUrl !== 'string' || envUrl.trim() === '') {
-    throw new Error('envUrl must be a non-empty string.');
-  }
-
-  let parsed;
-  try {
-    parsed = new URL(envUrl);
-  } catch {
-    throw new Error(`envUrl is not a valid URL: "${envUrl}".`);
-  }
-
-  if (parsed.protocol !== 'https:') {
-    throw new Error(`envUrl must use https (got "${parsed.protocol}").`);
-  }
-
-  if (parsed.username || parsed.password) {
-    throw new Error('envUrl must not contain userinfo (username/password). Authentication uses the Azure CLI token, not credentials in the URL.');
-  }
-
-  // url.origin is the scheme + host + port — no path, no query, no fragment.
-  // For "https://contoso.crm.dynamics.com:443/api/data/v9.2/?x=1#anchor"
-  // it returns "https://contoso.crm.dynamics.com:443".
-  return parsed.origin;
+  return helpers.validateDataverseEnvironmentUrl(envUrl, 'envUrl');
 }
 
 /**