Problem

When users specified custom allowed_domains for Playwright tools, the localhost domains (localhost and 127.0.0.1) were completely replaced instead of being preserved alongside the custom domains. This broke local development and testing workflows.

Before (broken behavior):

tools:
  playwright:
    allowed_domains: ["github.com", "*.github.com"]

Result: "github.com,*.github.com" ❌ (localhost access lost)

After (fixed behavior):

tools:
  playwright:
    allowed_domains: ["github.com", "*.github.com"]

Result: "localhost,127.0.0.1,github.com,*.github.com" ✅ (localhost preserved)

Root Cause

The issue existed in two locations where custom domains completely overwrote the default localhost domains:

1. pkg/parser/mcp.go (lines 177, 179-186): MCP configuration parser
2. pkg/workflow/compiler.go (line 3029): Workflow compilation logic

Both locations used direct assignment instead of merging domains.

Solution

Added ensureLocalhostDomains helper functions that intelligently merge localhost domains with custom domains:

• Checks if localhost and 127.0.0.1 are already present in the custom domains
• Adds missing localhost domains to the beginning of the list
• Preserves all user-specified custom domains
• Maintains the same order for predictable behavior

Testing

• Updated existing tests to expect localhost domains alongside custom domains
• Added comprehensive test coverage for the helper functions
• Manual verification confirms the fix works correctly in compiled workflows
• All existing tests pass with no regressions

Impact

This fix ensures that Playwright workflows maintain localhost access for local development and testing while respecting user-defined custom domains. The change is backward compatible and enhances both security and functionality.

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.