fix(browser): disable client `cdp` API when `allowWrite/allowExec: false` by hi-ogawa · Pull Request #10444 · vitest-dev/vitest

hi-ogawa · 2026-05-25T09:18:07Z

Description

backport v4 fix(browser): disable client cdp API when allowWrite/allowExec: false [backport to v4] #10450
backport v3 fix(browser): disable client cdp API when allowWrite/allowExec: false [backport to v3] #10456

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. If the feature is substantial or introduces breaking changes without a discussion, PR might be closed.
Ideally, include a test that fails without this PR but passes with it.
Please, don't make changes to pnpm-lock.yaml unless you introduce a new test example.
Please check Allow edits by maintainers to make review process faster. Note that this option is not available for repositories that are owned by Github organizations.

Tests

Run the tests with pnpm test:ci.

Documentation

If you introduce new functionality, document it. You can run documentation with pnpm run docs command.

Changesets

Changes in changelog are generated from PR name. Please, make sure that it explains your changes in an understandable manner. Please, prefix changeset messages with feat:, fix:, perf:, docs:, or chore:.

Co-authored-by: Codex <noreply@openai.com>

netlify · 2026-05-25T09:19:26Z

✅ Deploy Preview for vitest-dev ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`c4a4204`
🔍 Latest deploy log	https://app.netlify.com/projects/vitest-dev/deploys/6a17a87ffc64260009f79847
😎 Deploy Preview	https://deploy-preview-10444--vitest-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

hi-ogawa · 2026-05-25T09:47:36Z

+      send: cdp.send.bind(cdp),
+      on: cdp.on.bind(cdp),
+      off: cdp.off.bind(cdp),
+      once: cdp.once.bind(cdp),


We had weird ambient type from packages/coverage-v8/src/browser.ts and affected this part somehow. Did a quick ugly fix.

hi-ogawa · 2026-05-25T09:51:27Z

+import type { BrowserCommand } from 'vitest/node'
+import type { BrowserServerCDPHandler } from '../cdp'
+
+export const _startV8Coverage: BrowserCommand<[]> = async (context) => {
+  const session: BrowserServerCDPHandler = await context.__ensureCDPHandler()
+  await session.send('Profiler.enable')
+  await session.send('Profiler.startPreciseCoverage', {
+    callCount: true,
+    detailed: true,
+  })
+}
+
+export const _takeV8Coverage: BrowserCommand<[]> = async (context) => {
+  const session: BrowserServerCDPHandler = await context.__ensureCDPHandler()
+  return session.send('Profiler.takePreciseCoverage')
+}


This now restricts exposure to only these cdp commands. This would still expose runtime test code information, but it's just as bad as what readFile command or Vite's already exposes based on server.fs, so it should be fine.

Co-authored-by: Codex <noreply@openai.com>

pkg-pr-new · 2026-05-28T02:30:15Z

@vitest/browser

npm i https://pkg.pr.new/@vitest/browser@10444

@vitest/browser-playwright

npm i https://pkg.pr.new/@vitest/browser-playwright@10444

@vitest/browser-preview

npm i https://pkg.pr.new/@vitest/browser-preview@10444

@vitest/browser-webdriverio

npm i https://pkg.pr.new/@vitest/browser-webdriverio@10444

@vitest/coverage-istanbul

npm i https://pkg.pr.new/@vitest/coverage-istanbul@10444

@vitest/coverage-v8

npm i https://pkg.pr.new/@vitest/coverage-v8@10444

@vitest/expect

npm i https://pkg.pr.new/@vitest/expect@10444

@vitest/mocker

npm i https://pkg.pr.new/@vitest/mocker@10444

@vitest/pretty-format

npm i https://pkg.pr.new/@vitest/pretty-format@10444

@vitest/runner

npm i https://pkg.pr.new/@vitest/runner@10444

@vitest/snapshot

npm i https://pkg.pr.new/@vitest/snapshot@10444

@vitest/spy

npm i https://pkg.pr.new/@vitest/spy@10444

@vitest/ui

npm i https://pkg.pr.new/@vitest/ui@10444

@vitest/utils

npm i https://pkg.pr.new/@vitest/utils@10444

vitest

npm i https://pkg.pr.new/vitest@10444

@vitest/web-worker

npm i https://pkg.pr.new/@vitest/web-worker@10444

commit: c4a4204

hi-ogawa · 2026-05-28T02:30:58Z

@codex review

chatgpt-codex-connector · 2026-05-28T02:35:10Z

Codex Review: Didn't find any major issues. 🎉

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

This PR hardens browser-mode CDP access by blocking the public client cdp() API when write or exec permissions are disabled, while keeping internal V8 browser coverage functional through server-side commands.

Changes:

Adds CDP permission checks to browser RPC handlers.
Moves V8 browser coverage CDP calls behind internal browser commands.
Updates tests and documentation for the new CDP permission behavior.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`packages/browser/src/node/rpc.ts`	Adds CDP permission gating and exposes an internal cached CDP handler to server commands.
`packages/browser/src/node/commands/coverage.ts`	Adds internal commands for starting and taking V8 coverage via CDP.
`packages/browser/src/node/commands/index.ts`	Registers the new internal V8 coverage commands.
`packages/coverage-v8/src/browser.ts`	Uses internal commands instead of the public browser `cdp()` API.
`packages/vitest/src/node/types/browser.ts`	Documents the internal cached CDP handler on browser command context.
`packages/browser-playwright/src/playwright.ts`	Simplifies Playwright CDP session method forwarding.
`test/browser/specs/errors.test.ts`	Adds coverage for public `cdp()` failure when browser API permissions are disabled.
`test/coverage-test/test/browser-api-permissions.browser.test.ts`	Verifies browser V8 coverage still works with API write/exec disabled.
`docs/config/browser/api.md`	Documents that browser API permissions gate privileged CDP access.
`docs/api/browser/context.md`	Adds CDP permission warning to browser context docs.
`docs/api/browser/commands.md`	Adds CDP permission warning to browser commands docs.

sheremet-va · 2026-05-28T08:01:38Z

+import type { BrowserServerCDPHandler } from '../cdp'
+
+export const _startV8Coverage: BrowserCommand<[]> = async (context) => {
+  const session: BrowserServerCDPHandler = await context.__ensureCDPHandler()


I think this could even be a public API to be honest (in v5). Not blocking though

hi-ogawa and others added 4 commits May 25, 2026 16:44

fix(browser): gate cdp behind api permissions

cb436b1

Co-authored-by: Codex <noreply@openai.com>

refactor(browser): use internal cdp command for v8 coverage

b84c8e5

Co-authored-by: Codex <noreply@openai.com>

nit

276fa3c

nit

63ae913

hi-ogawa added 4 commits May 25, 2026 18:22

nit

6afc6a6

Merge branch 'main' into fix/browser-cdp-api-permissions

f46d94c

chore: typecheck

4260c0c

chore: tweak type

431f4da

hi-ogawa commented May 25, 2026

View reviewed changes

hi-ogawa and others added 4 commits May 26, 2026 08:52

chore: fix type

26f6cc7

Merge branch 'main' into fix/browser-cdp-api-permissions

49c120f

test: cover browser coverage with disabled api permissions

a88ab04

Co-authored-by: Codex <noreply@openai.com>

nit

65ef03d

hi-ogawa added the cr-tracked label May 28, 2026

Merge branch 'main' into fix/browser-cdp-api-permissions

c4a4204

hi-ogawa requested a review from Copilot May 28, 2026 02:30

Copilot started reviewing on behalf of hi-ogawa May 28, 2026 02:31 View session

Copilot AI reviewed May 28, 2026

View reviewed changes

hi-ogawa marked this pull request as ready for review May 28, 2026 02:52

hi-ogawa requested review from AriPerkkio and sheremet-va May 28, 2026 04:28

sheremet-va approved these changes May 28, 2026

View reviewed changes

sheremet-va merged commit 63e3b2e into vitest-dev:main May 28, 2026
15 of 19 checks passed

hi-ogawa deleted the fix/browser-cdp-api-permissions branch May 28, 2026 08:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(browser): disable client `cdp` API when `allowWrite/allowExec: false`#10444

fix(browser): disable client `cdp` API when `allowWrite/allowExec: false`#10444
sheremet-va merged 13 commits into
vitest-dev:mainfrom
hi-ogawa:fix/browser-cdp-api-permissions

hi-ogawa commented May 25, 2026 •

edited

Loading

Uh oh!

netlify Bot commented May 25, 2026 •

edited

Loading

Uh oh!

hi-ogawa May 25, 2026

Uh oh!

hi-ogawa May 25, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented May 28, 2026

Uh oh!

hi-ogawa commented May 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

sheremet-va May 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

hi-ogawa commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Documentation

Changesets

Uh oh!

netlify Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for vitest-dev ready!

Uh oh!

hi-ogawa May 25, 2026

Choose a reason for hiding this comment

Uh oh!

hi-ogawa May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new Bot commented May 28, 2026

Uh oh!

hi-ogawa commented May 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

sheremet-va May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hi-ogawa commented May 25, 2026 •

edited

Loading

netlify Bot commented May 25, 2026 •

edited

Loading

hi-ogawa May 25, 2026 •

edited

Loading

sheremet-va May 28, 2026 •

edited

Loading