remorses__playwriter

mirror of https://github.com/remorses/playwriter.git synced 2026-09-14 16:37:40 +08:00

Files

T

Tommy D. Rossi 9722518c5d Close wildcard CORS on recorder start/stop.

The toolbar Record button already starts recording from the extension
service worker (chrome-extension:// origin). Allowing any website origin
on POST /recorder/start and /recorder/stop was leftover from when the
page fetched the relay directly.

A page can no longer pass the CORS preflight, so it cannot start or
stop a recording. The worker fetch still skips the Sec-Fetch-Site block
because chrome-extension:// to 127.0.0.1 is cross-site.

Also switch the idle-icon tutorial to npx playwriter examples, bump
the extension to 0.0.118, and tighten the changeset/extension rules
in AGENTS.md.

Session: ses_fd2023624ffeK812PCDMCsUNVJ

2026-08-23 11:43:25 +02:00