Fix: wire GSTACK_CHROMIUM_PATH into headless launch, forward proxy config, and trust custom CA - #2457
Closed
erangini-ai wants to merge 1 commit into
Closed
Conversation
… and trust custom CA launch() (headless) ignored GSTACK_CHROMIUM_PATH entirely, unlike launchHeaded() — sandboxed hosts (Claude Code web/remote) that pre-install a pinned Chromium and block Playwright's own download would still fail with "Executable doesn't exist" on default (headless) /browse. Also forward HTTPS_PROXY as --proxy-server so the browser process routes through the session's outbound proxy instead of attempting a direct connection, and set ignoreHTTPSErrors (the Playwright-level equivalent — Chromium has no CA-file trust flag) so it accepts a MITM-style proxy's injected certificate. NODE_EXTRA_CA_CERTS is set alongside for this process's own TLS stack, though it has no effect on Chromium itself. Verified via file:// URL (no external network dependency): both headless and headed launch and render without the executable error. Real internet navigation is still bounded by whatever the host's outbound network policy allows — this fix only removes the browser-launch failure.
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
|
An error occurred while submitting your PR to the queue: |
9 tasks
Owner
|
Closing: this was absorbed or superseded on main by v1.67.0.0 or earlier (see the v1.67 tracker-wave receipts in PR #2604). Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
On sandboxed hosts (e.g., Claude Code web/remote) where Playwright's Chromium download is blocked, gstack bundles a pre-installed Chromium and sets
GSTACK_CHROMIUM_PATH. However, only headed/browse(launchHeaded()) actually used that variable — headless/browse(launch()) ignored it entirely, still hitting the "Executable doesn't exist" error.This PR fixes that, plus two related proxy/Certificate Authority gaps that prevent the browser from functioning inside MITM-proxied environments.
Changes
Wire
GSTACK_CHROMIUM_PATHinto headless launchlaunch()now readsGSTACK_CHROMIUM_PATHand passes it asexecutablePathwhen set, matching the existinglaunchHeaded()behavior. Falls back to Playwright's default when the variable is absent.Forward
HTTPS_PROXYto ChromiumThe browser process now passes
--proxy-server=<value>(derived fromHTTPS_PROXY) so outbound traffic routes through the session's proxy instead of attempting a direct connection.Trust the proxy's custom Certificate Authority
Added
ignoreHTTPSErrors: true(Playwright‑level) so the browser accepts certificates injected by the MITM‑style proxy. Also setsNODE_EXTRA_CA_CERTSfor the Node process's own TLS stack (has no effect on Chromium itself, but useful for other network calls in the same context).Testing
Verified in a proxy‑restricted Firecracker VM using a
file://URL (zero external network dependency):/browsenavigates and renders successfully — no "Executable doesn't exist" error./browse(xvfb‑run) passes the same test, no Chromium download attempted.--proxy-serverflag is confirmed present in the launched Chromium command line.Real‑internet navigation remains subject to the host's outbound network policy; this fix is focused solely on eliminating the browser‑launch failure.