chore: fix the mcp sandbox settings (microsoft#38977)

Author: pavelfeldman

packages/playwright/src/mcp/browser/config.ts

@@ -82,7 +82,6 @@ export const defaultConfig: FullConfig = {
     launchOptions: {
       channel: 'chrome',
       headless: os.platform() === 'linux' && !process.env.DISPLAY,
-      chromiumSandbox: true,
     },
     contextOptions: {
       viewport: null,
@@ -127,7 +126,7 @@ const defaultDaemonConfig = (cliOptions: CLIOptions) => mergeConfig(defaultConfi
 type BrowserUserConfig = NonNullable<Config['browser']>;
 
 export type FullConfig = Config & {
-  browser: Omit<BrowserUserConfig, 'browserName'> & {
+  browser: Omit<BrowserUserConfig, 'browserName' | 'launchOptions' | 'contextOptions'> & {
     browserName: 'chromium' | 'firefox' | 'webkit';
     launchOptions: NonNullable<BrowserUserConfig['launchOptions']>;
     contextOptions: NonNullable<BrowserUserConfig['contextOptions']>;
@@ -161,6 +160,7 @@ export async function resolveCLIConfig(cliOptions: CLIOptions): Promise<FullConf
   result = mergeConfig(result, configInFile);
   result = mergeConfig(result, envOverrides);
   result = mergeConfig(result, cliOverrides);
+
   if (cliOptions.daemon)
     result.skillMode = true;
 
@@ -170,6 +170,13 @@ export async function resolveCLIConfig(cliOptions: CLIOptions): Promise<FullConf
     result.browser.userDataDir = `${cliOptions.daemonDataDir}-${browserToken}`;
   }
 
+  if (result.browser.browserName === 'chromium' && result.browser.launchOptions.chromiumSandbox === undefined) {
+    if (process.platform === 'linux')
+      result.browser.launchOptions.chromiumSandbox = result.browser.launchOptions.channel !== 'chromium';
+    else
+      result.browser.launchOptions.chromiumSandbox = true;
+  }
+
   await validateConfig(result);
   return result;
 }
@@ -222,11 +229,10 @@ export function configFromCLIOptions(cliOptions: CLIOptions): Config {
     headless: cliOptions.headless,
   };
 
+  // --sandbox was passed, enable the sandbox
   // --no-sandbox was passed, disable the sandbox
-  if (cliOptions.sandbox === false)
-    launchOptions.chromiumSandbox = false;
-  if (process.env.CI && process.platform === 'linux')
-    launchOptions.chromiumSandbox = false;
+  if (cliOptions.sandbox !== undefined)
+    launchOptions.chromiumSandbox = cliOptions.sandbox;
 
   if (cliOptions.proxyServer) {
     launchOptions.proxy = {

packages/playwright/src/mcp/program.ts

@@ -62,6 +62,7 @@ export function decorateCommand(command: Command, version: string) {
       .option('--port <port>', 'port to listen on for SSE transport.')
       .option('--proxy-bypass <bypass>', 'comma-separated domains to bypass proxy, for example ".com,chromium.org,.domain.com"')
       .option('--proxy-server <proxy>', 'specify proxy server, for example "http://myproxy:3128" or "socks5://myproxy:8080"')
+      .option('--sandbox', 'enable the sandbox for all process types that are normally not sandboxed.')
       .option('--save-session', 'Whether to save the Playwright MCP session into the output directory.')
       .option('--save-trace', 'Whether to save the Playwright Trace of the session into the output directory.')
       .option('--save-video <size>', 'Whether to save the video of the session into the output directory. For example "--save-video=800x600"', resolutionParser.bind(null, '--save-video'))
@@ -80,6 +81,10 @@ export function decorateCommand(command: Command, version: string) {
       .addOption(new ProgramOption('--daemon-data-dir <path>', 'path to the daemon data directory.').hideHelp())
       .addOption(new ProgramOption('--daemon-headed', 'run daemon in headed mode').hideHelp())
       .action(async options => {
+
+        // normalize the --no-sandbox option: sandbox = true => nothing was passed, sandbox = false => --no-sandbox was passed.
+        options.sandbox = options.sandbox === true ? undefined : false;
+
         setupExitWatchdog();
 
         if (options.vision) {

tests/mcp/config.spec.ts

@@ -17,7 +17,7 @@
 import fs from 'node:fs';
 
 import { test, expect } from './fixtures';
-import { configFromCLIOptions } from '../../packages/playwright/lib/mcp/browser/config';
+import { resolveCLIConfig } from '../../packages/playwright/lib/mcp/browser/config';
 import type { Config } from '../../packages/playwright/src/mcp/config';
 
 test('config user data dir', async ({ startClient, server }, testInfo) => {
@@ -78,14 +78,15 @@ test.describe(() => {
   });
 });
 
-test.describe('sandbox configuration', () => {
-  test('should enable sandbox by default (no --no-sandbox flag)', async () => {
-    const config = configFromCLIOptions({ sandbox: undefined });
-    expect(config.browser?.launchOptions?.chromiumSandbox).toBeUndefined();
-  });
+async function sandboxOption(cli: any) {
+  const config: any = await resolveCLIConfig(cli);
+  return config.browser.launchOptions.chromiumSandbox;
+}
 
-  test('should disable sandbox when --no-sandbox flag is passed', async () => {
-    const config = configFromCLIOptions({ sandbox: false });
-    expect(config.browser?.launchOptions?.chromiumSandbox).toBe(false);
-  });
+test('test sandbox configuration', async ({}) => {
+  expect(await sandboxOption({ browser: 'chromium' })).toBe(process.platform !== 'linux');
+  expect(await sandboxOption({ browser: 'chromium', sandbox: true })).toBe(true);
+  expect(await sandboxOption({ browser: 'chrome', sandbox: false })).toBe(false);
+  expect(await sandboxOption({ browser: 'chrome' })).toBe(true);
+  expect(await sandboxOption({ browser: 'msedge' })).toBe(true);
 });

tests/mcp/fixtures.ts

@@ -98,8 +98,6 @@ export const test = serverTest.extend<TestFixtures & TestOptions, WorkerFixtures
         if (!options?.args?.some(arg => arg.startsWith('--config')))
           args.push(`--config=${test.info().outputPath()}`);
       } else {
-        if (process.env.CI && process.platform === 'linux')
-          args.push('--no-sandbox');
         if (mcpBrowser)
           args.push(`--browser=${mcpBrowser}`);
         if (options?.config) {