Skip to content

fix(playwright): document video-start --size and correct the frame-size guidance - #1586

Merged
kyle-sexton merged 3 commits into
mainfrom
fix/playwright-video-frame-size
Jul 26, 2026
Merged

fix(playwright): document video-start --size and correct the frame-size guidance#1586
kyle-sexton merged 3 commits into
mainfrom
fix/playwright-video-frame-size

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Closes #1575
Closes #1576
Closes #1577

The problem

The playwright skill's canonical video example is a bare
playwright-cli video-start demo.webm. That deterministically produces an 800x450 file. An
operator following the skill verbatim — including setting a large viewport with resize — gets
800x450 recordings every time, and nothing in the skill explains why or how to change it. The
downstream report was nine E2E screen recordings, all 800x450, after a 1920x1200 resize.

Which fix is correct, and why (stated explicitly)

The task framing offers two valid resolutions: make the guarantee true, or stop claiming it.

--size does exist upstream — verified in help.json extracted from @playwright/cli@0.1.17,
the exact version this skill's frontmatter pins:

Options:
  --size    video frame size, e.g. "800x600". if not specified, the size of the recorded video will fit 800x800.

So the guarantee is deliverable, and this PR makes it true rather than retracting it. Worth being
explicit about what "behavior" means for a skill: this skill's behavior is the commands it
instructs an agent to run.
Changing the canonical example to pass --size is therefore the
behavior fix, not a prose paper-over of a broken one. There is no separate code path left unfixed.

The one place I did choose retraction over repair is the cost figure — see defect 3.

Verdicts on the three reported defects

1. --size undocumented — REAL (#1575)

Confirmed three ways: the installed CLI's --help, help.json from the pinned 0.1.17, and an
ffprobe-measured repro. The string --size appeared nowhere in the skill.

2. "Defaults (accept, don't override)" steers wrong — REAL, but NARROWER than reported

The report framed this as the section contradicting the fix. On inspection it is more precisely an
omission, and two sub-claims do not survive:

  • The | Viewport | 1280x720 | row is factually correct — that is the CLI's default viewport, per
    the @playwright/cli@0.1.17 README (PLAYWRIGHT_MCP_VIEWPORT_SIZE — "specify browser viewport size
    in pixels, for example "1280x720""). It is not a defect and it stays.
  • The section says "don't add PLAYWRIGHT_MCP_* env vars to project settings". The video fix is a
    per-command env prefix on open, which that sentence does not forbid. Not a contradiction.

What was genuinely missing is a documented exception: an agent reading "accept, don't override" next
to a 1280x720 row reasonably concludes the viewport is not a knob to touch. So the fix here is one
added carve-out paragraph with a cross-link — not the section rework the report suggested. Demolishing
the section would be overreach the evidence does not support.

3. "1280x720 WebM is ~5 MB/minute" — REAL

Two errors in one line. The CLI never emits 1280x720 by default, and the ~5 MB/minute figure is
unsourced — it appears in no upstream skill, no @playwright/cli README, and no official Playwright
doc. Deliberately removed rather than re-anchored to 800x450: correcting only the resolution
would relocate the fabrication instead of fixing it, and short clips of a static page cannot ground a
replacement number. Replaced with a qualitative statement (size scales with frame area and on-screen
motion).

Evidence

Empirical repro, ffprobe on the resulting .webm, @playwright/cli 0.1.14 on Windows:

Scenario Measured
open, bare video-start vp8, 800, 450
open, resize 1920 1200, bare video-start vp8, 800, 450resize does not move it
PLAYWRIGHT_MCP_VIEWPORT_SIZE=1920x1200 open, bare video-start vp8, 800, 500
open, video-start --size "1920x1200" vp8, 1920, 1200 — but a frame extracted at n=20 shows the 1280x720 render in the top-left corner, rest padded grey
both levers, matched vp8, 1920, 1200, correct

That last row refines the original report, which described it as an "upscaled 1280-wide render". It is
not upscaled — it is letterboxed top-left, exactly as
https://playwright.dev/docs/videos describes: "The video of the viewport is placed in the top-left
corner of the output video, scaled down to fit if necessary."

Sources, all fetched or executed this session:

  • help.json from @playwright/cli@0.1.17 (npm tarball, the pinned version) — --size present,
    identical text to 0.1.14; flags: { size: "string" }
  • @playwright/cli@0.1.17 README — PLAYWRIGHT_MCP_VIEWPORT_SIZE env var and format; the
    .playwright/cli.config.json schema showing browser.contextOptions and a top-level
    saveVideo: { width, height }
  • https://playwright.dev/docs/api/class-browser#browser-new-contextrecordVideo.size: "If not
    specified the size will be equal to viewport scaled down to fit into 800x800. If viewport is not
    configured explicitly the video size defaults to 800x450."
  • https://playwright.dev/docs/videos — "You may need to set the viewport size to match your desired
    video size."

Repo-convention compliance

  • Version: 0.4.00.5.0. Precedent in this plugin's own CHANGELOG: 0.3.1/0.3.2 were pure doc
    corrections → patch; 0.4.0 folded in newly-surfaced upstream commands and flags → minor. Surfacing
    --size matches the 0.4.0 pattern.
  • Frontmatter untouched. No listing description or trigger-keyword change was needed, so none was
    made. check-skill.sh confirms "all 10 base-ref trigger phrase(s) preserved".
  • vendor/ untouched. It is a verbatim upstream baseline for drift detection; editing it would
    make the next update --check report false drift. Upstream's own shipped skill omits --size too —
    that is an upstream gap, noted as reportable, not patched here.
  • Repo-agnostic. The reported fix used 1920x1200, the reporting operator's personal preference.
    Not baked in — the docs use a neutral illustrative 1440x900 and teach the pattern (set viewport
    at open AND pass --size, matched), since the number is the consumer's call.
  • Fresh-docs mandate. Scope is contract surfaces; this change is confined to skill prose bodies
    with frontmatter untouched, so it falls outside that scope. The load-bearing claims are grounded in
    the pinned package's own help.json and README plus playwright.dev, all obtained this session and
    cited above. No stale docs.claude.com URLs exist under plugins/playwright.

Checks run locally

  • check-skill.sh playwrightPASS, 0 errors (1 pre-existing advisory warning: no Gotchas surface)
  • validate-plugins.sh — all manifests + catalog pass
  • check-changelog-parity.sh --check and --check-bump origin/main — pass
  • check-skill-portability.sh origin/main, check-contract-slice-prune.sh --check-diff origin/main,
    check-shell-portability.sh origin/main, generate-catalog.mjs --check — pass

Deliberately deferred

  • A dedicated ## Gotchas section. The report suggested one for "resize does not affect video
    frame size". That fact now lives in two places a reader actually hits — the SKILL.md Defaults
    exception (the exact spot that previously steered wrong) and the measured-outcomes table. A separate
    section would duplicate it to silence an advisory warning that predates this PR.
  • The .playwright/cli.config.json route. The README schema shows browser.contextOptions
    (accepts viewport) and a top-level saveVideo: { width, height }, and confirms saveVideo governs
    whole-session auto-save — a different mechanism from on-demand video-start. Documented as such and
    explicitly flagged unverified, since I did not measure it.
  • Reporting the --size omission upstream to microsoft/playwright-cli.

Not verified

Official Playwright docs do not anywhere state that video frame size is fixed at context creation
and immune to a later resize. I searched docs/src/videos.md and the Page.setViewportSize section of
docs/src/api/class-page.md in full. The claim is therefore attributed to measurement in this repo's
wording ("resize does not change the video frame size" — what ffprobe showed), never asserted as
documented upstream behavior.

Related

  • docs: migrate remaining docs.claude.com URLs to code.claude.com #1567 — migrated remaining docs.claude.com URLs to code.claude.com repo-wide. Merged before
    this branch was cut, so there was no collision. Verified independently that no stale
    docs.claude.com URL remains under plugins/playwright; this PR adds none.
  • Upstream microsoft/playwright-cli — its own shipped skill
    (vendor/references/video-recording.md) omits --size too. Not closed by this PR and not patched
    here, since vendor/ is a verbatim drift-detection baseline; reportable upstream as follow-up.
  • No ADR or decision-log entry applies — this is a documentation-correctness fix inside one plugin,
    with no architecture or contract-surface decision attached.

🤖 Generated with Claude Code

…ze guidance

A bare `playwright-cli video-start <name>.webm` — the skill's canonical
example — records at 800x450 regardless of viewport intent, because the
video frame size is derived from the viewport at browser-context creation
and then fitted into an 800x800 box. `resize` afterwards does not change
it. The `--size` flag that fixes this appeared nowhere in the skill.

- Add a "Frame size — two levers, not one" section to
  reference/tracing-and-video.md: PLAYWRIGHT_MCP_VIEWPORT_SIZE on `open`
  governs what the page renders at, `video-start --size` governs the output
  frame, and a correct recording needs both matched. Tabulates the measured
  outcome of every partial combination.
- Make the canonical video example carry both levers, at a neutral
  illustrative resolution.
- Add a video-recording exception to SKILL.md "Defaults (accept, don't
  override)". The 1280x720 viewport row is correct and stays; what was
  missing was the carve-out. Frontmatter untouched.
- Drop the "1280x720 WebM is ~5 MB/minute" cost claim: the CLI never emits
  1280x720 by default and the figure is unsourced.

Verified against @playwright/cli 0.1.17 help.json (the pinned version),
playwright.dev recordVideo.size and Videos docs, and an ffprobe-measured
five-scenario repro.

Closes #1575
Closes #1576
Closes #1577

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@claude

claude Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 2m 2s —— View job


PR Review — fix(playwright): document video-start --size and correct the frame-size guidance

  • Gather context and understand the PR
  • Read changed files
  • Review plugin.json (version bump)
  • Review CHANGELOG.md
  • Review SKILL.md
  • Review reference/tracing-and-video.md (main change)

Overview

This is a well-researched, well-scoped documentation fix. All three reported defects are handled at the right level — the --size omission is fixed by actually using the flag (rather than retracting the guarantee), the misleading "Defaults" section gets a targeted carve-out rather than a rework, and the fabricated cost figure is cleanly removed. The PR body's reasoning is transparent and the evidence is solid.


plugin.json — Version bump 0.4.00.5.0

Correct. The precedent in this plugin's own changelog is: 0.3.x = doc corrections → patch; 0.4.0 = newly-surfaced upstream commands/flags → minor. Surfacing --size (a previously unmentioned upstream flag) and changing the canonical example match that same pattern, so minor is the right call here.

permalink


CHANGELOG.md

Correct Keep a Changelog format (Added / Changed / Fixed). All three entries accurately describe what was changed and why. Consistent with how earlier versions are documented. No issues.


SKILL.md — Video-recording exception paragraph

The added paragraph at line 78 is well-placed and the reasoning is sound:

permalink

  • Correctly explains the two-lever mechanism in the place a reader first hits it (the Defaults table)
  • The self-referential clarification ("That is a per-command prefix, not a project-settings entry, so it does not contradict the guidance above") proactively handles the apparent contradiction
  • Cross-link to reference/tracing-and-video.md uses the correct relative path from SKILL.md's location ✓
  • Frontmatter untouched ✓

reference/tracing-and-video.md — Main change

Video — basic section (lines 40–49): The old example was wrong by omission on three dimensions at once — no session name (against the skill's own convention), no viewport env var, no --size. The replacement fixes all three and is now internally consistent with the SKILL.md Quick Start pattern. permalink

Frame size — two levers, not one (lines 68–104): Clear structure. The lead sentence is direct and actionable. The two-row lever table is the right format for this kind of "matched pair" concept. The measured-outcomes table is appropriately attributed to the specific CLI version tested (0.1.14) — which is not the pinned 0.1.17, but the PR body explains the cross-version confirmation. The saveVideo paragraph is honestly marked unverified rather than asserted. permalink

Workflow checklist step 3 (lines 123–125): Updated to include --size "<W>x<H>" with a viewport reminder and cross-reference. permalink

Known costs (lines 132–133): Removing the unsourced ~5 MB/minute figure and replacing with a proportionality statement is the right call. The replacement is honest — "measure your own flow rather than budgeting from a rule of thumb" gives agents useful direction without inventing a number. permalink


Minor observations (non-blocking)

1. Placeholder casing inconsistency in the outcomes table.
The lever table uses <W>x<H> (uppercase), but the outcomes table row reads resize <w> <h> (lowercase), and the PLAYWRIGHT_MCP_VIEWPORT_SIZE=1920x1200 open rows use literal values. The inconsistency is only cosmetic, but resize <W> <H> would match the lever table's convention.

permalinkresize <w> <h> → consider resize <W> <H>

2. "both levers, matched" row in the outcomes table is the only row that doesn't show a concrete measured dimension. All other rows show a specific pixel outcome. A closing row like "both levers, matched | 1920×1200 — correct" would make the payoff explicit rather than relying on the reader to infer it. Very minor; the intent is unambiguous.


CLAUDE.md compliance

  • Fresh-docs mandate: The PR correctly identifies this change as outside scope (skill prose bodies, not frontmatter or schema surfaces). The load-bearing claims are cited to help.json, the upstream README, and playwright.dev — all obtained this session. ✓
  • Repo-agnostic: 1440x900 is presented as illustrative; the docs teach the pattern, not a hardcoded resolution. ✓
  • Versioned: plugin.json bumped + changelog entry. ✓
  • No PII / secrets: Documentation only. ✓

Security

Documentation-only change. No code execution paths, no remote MCP server configs, no env-var secrets, no egress. No security concerns.


Verdict

LGTM. The two minor observations above are cosmetic and non-blocking. The substantive fix — teaching agents the two-lever pattern they need to get the video frame size they intend — is correct, well-evidenced, and properly scoped. The choice to fix the behavior rather than retract the guarantee, and to honestly label the saveVideo path as unverified, both reflect good judgment.

@claude

claude Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 41s —— View job


Security Review — PR #1586

  • Read PR diff and changed files
  • Analyze for injection surfaces and trust-boundary issues
  • Check for credential/secret exposure risks
  • Review skill command instructions for injection patterns
  • Report findings

Summary

This is a documentation-only PR. The four changed files are plugin.json (version bump), CHANGELOG.md, SKILL.md (one added paragraph), and reference/tracing-and-video.md (new "Frame size" section). No executable code, no GitHub Actions changes, no secrets, no new remote trust delegations. The security surface of these changes is minimal.

Findings

No CRITICAL or IMPORTANT security findings.

One low-confidence observation worth noting for completeness:

SUGGESTION — Confidence: LOW

reference/tracing-and-video.md line 82

The table shows the env-var lever as:

PLAYWRIGHT_MCP_VIEWPORT_SIZE=<W>x<H>  prefixed on the `open` command

without quotes around <W>x<H>. The concrete example at line 41 (PLAYWRIGHT_MCP_VIEWPORT_SIZE=1440x900) is safe because a WxH resolution never contains shell metacharacters. However, the template form in the table could be misread by a naive AI consumer as "substitute any string the user says here," and a crafted value with spaces or semicolons (e.g. 1440x900; evil_cmd) would not be properly neutralised without quoting. The --size "<W>x<H>" argument line already shows quotes correctly.

This is not a regression — the same unquoted-template pattern already exists elsewhere in the skill (-s=<flow>) and was not introduced by this PR. Upstream playwright-cli's own format validation (NNNxNNN) makes exploitation in practice implausible. Noting it only so a future hardening pass can add "<W>x<H>" (with quotes) to the env-var column for consistency with the --size column.

Areas checked and found clean

Area Verdict
Secret / credential exposure None introduced
Command injection via shell patterns No new vectors; existing patterns unchanged
Path traversal No user-controlled paths introduced
GitHub Actions (workflow files) No files changed
Supply-chain / dependency pins plugin.json version bump only; no new packages
Trust delegation (remote MCP, external scripts) None introduced
Vendor directory treatment Existing "treat as untrusted DATA" guardrail preserved (SKILL.md line 92)

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c3d62e4395

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread plugins/playwright/skills/playwright/reference/tracing-and-video.md
…ell env syntax

MD051 flagged both `#frame-size-two-levers-not-one` links as invalid: an em
dash in a heading slugs to a DOUBLE hyphen, so `## Frame size — two levers,
not one` anchors as `#frame-size--two-levers-not-one`. Rename the heading to
the parenthetical form, which strips to single hyphens and matches the links
already in place — the same convention codebase-health's
`## Remediation (delegated to other plugins)` uses.

Also note that the `VAR=value <command>` env prefix in the new example is
POSIX-only, with the PowerShell `$env:` equivalent, since this skill ships a
Windows quirks reference and Windows consumers are a known audience.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@claude

claude Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 58s —— View job


Security Review — PR #1586

  • Gather context and understand the PR
  • Read PR diff (git diff origin/main...HEAD)
  • Read changed files
  • Analyze for injection surfaces, trust-boundary issues, and logic flaws
  • Report findings

Summary

This is a documentation-only PR. All four changed files are skill prose, changelog, and a manifest version bump — no executable code, no GitHub Actions modifications, no new dependencies, no remote trust delegations. The security surface is minimal.

Findings

No CRITICAL or IMPORTANT findings.

The one observation worth logging for completeness:

SUGGESTION — Confidence: LOW

reference/tracing-and-video.md line 81

The lever table shows the env-var form as:

PLAYWRIGHT_MCP_VIEWPORT_SIZE=<W>x<H>  prefixed on the `open` command

without quotes around the substitution site. The concrete examples (1440x900, 1920x1200) are safe — the WxH format contains no shell metacharacters. The --size "<W>x<H>" column already shows quotes correctly. A hardening pass could add "<W>x<H>" (quoted) to the env-var column for consistency and to model the defensive habit explicitly.

This pattern is not new to this PR — it matches the pre-existing -s=<flow> convention elsewhere in the skill — and upstream CLI format validation (NNNxNNN) makes exploitation in practice implausible. Included only because the previous security pass on this PR's earlier commit already flagged it at the same confidence level; the assessment is unchanged in the updated head.

Areas checked and found clean

Area Verdict
Secret / credential exposure None introduced
Command injection via shell patterns No new vectors; unquoted template is pre-existing and low-risk
Path traversal No user-controlled paths introduced
GitHub Actions (workflow files) No files changed
Supply-chain / dependency pins plugin.json version bump only; no new packages
Trust delegation (remote MCP, external scripts) None introduced
Logic / trust-boundary flaws in skill instructions None; saveVideo path is correctly marked unverified; resize non-effect is correctly documented

@claude

claude Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 2m 3s —— View job


PR Review — fix(playwright): document video-start --size and correct the frame-size guidance

  • Gather context and understand the PR
  • Read changed files
  • Review plugin.json (version bump)
  • Review CHANGELOG.md
  • Review SKILL.md
  • Review reference/tracing-and-video.md (main change)
  • Assess Codex suggestion about session selectors
  • Post final review

Overview

Well-researched, well-scoped fix. All three reported defects are handled correctly — --size is surfaced by actually using the flag (not retracting the guarantee), the Defaults section gets a targeted carve-out, and the unsourced ~5 MB/minute figure is cleanly removed. The two-lever explanation is clear and actionable.


plugin.json — Version bump 0.4.00.5.0

Correct. Precedent from this plugin's own changelog: 0.3.x = doc corrections → patch; 0.4.0 = newly-surfaced upstream flags → minor. Surfacing --size matches that pattern exactly.


CHANGELOG.md

Correct Keep a Changelog format (Added / Changed / Fixed). All three entries accurately describe what changed and why. No issues.


SKILL.md — Video-recording exception paragraph

The carve-out at line 78 is well-placed and correct:

  • Explains the two-lever mechanism at exactly the point a reader first hits the "don't override" guidance
  • The "per-command prefix, not a project-settings entry" clarification preemptively resolves the apparent contradiction
  • Cross-link uses the correct relative path from SKILL.md's location
  • Frontmatter untouched ✓

reference/tracing-and-video.md — Main change

Video — basic example (lines 40–46): The replacement fixes all three dimensions at once — session name added, viewport env var added, --size added — and is now internally consistent with the SKILL.md Quick Start pattern.

Frame size section (lines 68–108): Clear structure, well-attributed measured outcomes, saveVideo honestly marked unverified. The two-lever table is the right format for a "matched pair" concept.

Workflow checklist step 3 (lines 123–125): Updated correctly with --size and the viewport cross-reference.

Known costs (lines 132–133): Removing the unsourced figure and replacing with a proportionality statement is the right call.


Findings

1. Session selector gap in annotation snippets — FUNCTIONAL, introduced by this PR

The Codex reviewer's observation is valid and goes deeper than cosmetic. Before this PR, the basic example had no session selector, and neither did the adjacent annotation snippets — they were consistently targeting the default session. This PR added -s=demo to the basic example, creating a functional inconsistency: an agent following the newly-named demo flow and then copying the video-chapter or video-show-actions block will dispatch those commands to the unnamed default session, which has no active recording. sessions.md is explicit: "Use -s=<name> on every command in a flow."

Affected lines:

Snippet Line Missing
playwright-cli video-chapter ... 54 -s=demo
playwright-cli video-show-actions ... 59 -s=demo
playwright-cli click e1 (in show-actions block) 60 -s=demo
playwright-cli fill e2 "test" 61 -s=demo
playwright-cli video-hide-actions 62 -s=demo

These were pre-existing omissions, but this PR made them consequential by naming the session above. Fix this →

2. Placeholder casing inconsistency — cosmetic

The lever table (line 81–82) uses <W>x<H> (uppercase). The outcomes table row at line 96 uses resize <w> <h> (lowercase). resize <W> <H> would match the convention above.

3. "both levers, matched" outcome row — minor

The outcomes table shows "the size you asked for" rather than a concrete measurement. Every other row gives a specific pixel result; a closing row like "1920×1200 — correct" would make the payoff explicit and parallel the other rows.


CLAUDE.md compliance

  • Fresh-docs mandate: This change is confined to skill prose bodies with frontmatter untouched — outside scope. Load-bearing claims cited to help.json, upstream README, and playwright.dev. ✓
  • Repo-agnostic: 1440x900 presented as illustrative; docs teach the pattern. ✓
  • Versioned: plugin.json bumped + changelog entry. ✓
  • No PII / secrets: Documentation only. ✓

Security

Documentation-only change. No code execution paths, no new trust delegations, no secrets introduced. No security concerns.


Verdict

LGTM with one request to address before merge: the session selector gap (finding 1) is a functional issue introduced by this PR that would break annotation snippets for agents following the newly-named demo flow. Findings 2 and 3 are cosmetic and non-blocking.

Review catch. Naming the session in the basic video example left the
immediately following `video-chapter` and `video-show-actions` snippets on
the bare (unnamed) session, so a reader copying them in sequence would
target a different daemon than the one recording — the exact isolation
failure `reference/sessions.md` warns about, and contrary to this skill's
own "always use named sessions for multi-step work" convention.

The tracing example above is left bare: it is pre-existing, internally
self-consistent, and untouched by this PR.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@claude

claude Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 37s —— View job


PR Review — fix(playwright): document video-start --size and correct the frame-size guidance

  • Gather context and understand the PR
  • Read changed files at HEAD (6a496c6)
  • Review plugin.json and CHANGELOG.md
  • Review SKILL.md
  • Review reference/tracing-and-video.md
  • Check session-selector fix from latest commit
  • Post final review

Overview

Three commits, four files. All three reported defects fixed correctly. The previous review flagged one blocking issue (session selector gap in annotation snippets) — it is fully resolved in commit 6a496c6. The two remaining cosmetic observations from prior reviews are noted below and remain non-blocking.


Commit-by-commit summary

Commit What changed
c3d62e4 Core fix: --size documented, canonical example updated, SKILL.md carve-out added, unsourced cost figure removed
61d99f0 Repairs: anchor fragment, PowerShell env syntax note
6a496c6 Carries -s=demo through video-chapter, video-show-actions, click e1, fill e2, video-hide-actions snippets

plugin.json — Version bump 0.4.00.5.0

Correct. Precedent from this plugin's own changelog: 0.3.x = doc corrections → patch; 0.4.0 = newly-surfaced upstream flags → minor. Surfacing --size (a previously undocumented upstream flag) matches that pattern exactly. permalink


CHANGELOG.md

Correct Keep a Changelog format (Added / Changed / Fixed). All three entries accurately describe what changed and why. Consistent with earlier versions. permalink


SKILL.md — Video-recording exception paragraph

The carve-out at line 78 is well-placed and correct:

  • Inserted directly after the Defaults table — the exact point a reader first encounters "don't override" guidance
  • Accurately describes the two-lever mechanism and why a bare video-start records at 800×450
  • The "per-command prefix, not a project-settings entry" clarification resolves the apparent contradiction with the surrounding guidance
  • Cross-link uses the correct relative path from SKILL.md's location ✓
  • Frontmatter untouched ✓

reference/tracing-and-video.md — Main change

Session selector fix (commit 6a496c6) — fully correct. Every video command snippet in the file now carries -s=demo, matching the named session opened in the basic example. Previous state left video-chapter, video-show-actions, click, fill, and video-hide-actions targeting the unnamed session — copying them in sequence would have dispatched to a different daemon than the active recording. All five lines now consistent. permalink

Basic video example (lines 40–46): Fixed on all three dimensions — session name, viewport env var, --size. Internally consistent with SKILL.md Quick Start pattern.

Frame size section (lines 68–108): Clear structure and honest attribution. Measured outcomes table is versioned to @playwright/cli 0.1.14. PowerShell note is a useful addition. saveVideo correctly marked unverified.

Workflow checklist step 3 (lines 127–128): Updated correctly with --size and cross-reference.

Known costs (lines 136–138): Removing the unsourced ~5 MB/minute figure and replacing with a proportionality statement is the right call.


Remaining cosmetic observations (non-blocking, pre-existing)

1. Placeholder casing in outcomes tableline 96: resize <w> <h> uses lowercase while the lever table above uses <W>x<H>. resize <W> <H> would be consistent.

2. "both levers, matched" rowline 99: All other rows show a specific measured pixel result; this row says "the size you asked for". A concrete value like 1920×1200 — correct would parallel the other rows.

Neither requires action before merge.


CLAUDE.md compliance

  • Fresh-docs mandate: Skill prose bodies with frontmatter untouched — outside scope. Load-bearing claims cited to help.json, upstream README, and playwright.dev. ✓
  • Repo-agnostic: 1440x900 is illustrative; the docs teach the pattern. ✓
  • Versioned: plugin.json bumped + changelog entry. ✓
  • No PII / secrets: Documentation only. ✓

Security

Documentation-only change. No code execution paths, no remote trust delegations, no secrets introduced. No security concerns.


Verdict

LGTM. The blocking issue from the previous review (session selector gap in annotation snippets) is fully resolved in 6a496c6. The substantive fix — teaching agents the two-lever pattern required to get the video frame size they intend — is correct, well-evidenced, and appropriately scoped.

@claude

claude Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 31s —— View job


Security Review — PR #1586 (head: 6a496c6)

  • Read PR diff
  • Read changed files
  • Analyze for security issues
  • Report findings

Summary

All four changed files are skill prose, changelog, and a manifest version bump. No executable code, no GitHub Actions modifications, no new dependencies, no remote trust delegations, no credential handling. The head commit (6a496c6) added -s=demo to follow-up video snippets — a documentation consistency fix with no security surface of its own.

Findings

No CRITICAL or IMPORTANT findings.

One SUGGESTION, identical to what the two prior security passes on this PR's earlier commits logged — included for completeness and to confirm it has not changed at head:

SUGGESTION — Confidence: LOW

reference/tracing-and-video.md line 81

The lever table shows the env-var form as:

PLAYWRIGHT_MCP_VIEWPORT_SIZE=<W>x<H>  prefixed on the `open` command

without quotes around the substitution site. The --size "<W>x<H>" column on the next row correctly shows quotes. A defensive hardening pass could make these consistent — PLAYWRIGHT_MCP_VIEWPORT_SIZE="<W>x<H>" — to model the quoting habit explicitly. In practice, upstream CLI format validation (NNNxNNN) means a value containing shell metacharacters would be rejected before it caused harm. This pattern is also pre-existing elsewhere in the skill (-s=<flow>), not introduced by this PR. Low confidence, non-blocking.

New text examined and found clean

Addition Assessment
PowerShell env-var guidance ($env:PLAYWRIGHT_MCP_VIEWPORT_SIZE = '<W>x<H>') Single-quoted literal; correct template form for PS — no injection vector
External links (playwright.dev/docs/videos, playwright.dev/docs/api/class-browser) Legitimate upstream documentation URLs
saveVideo config note Correctly flagged unverified; no trust delegation
-s=demo session selectors (head commit) Hardcoded literal; no user-controlled input path

Areas checked and found clean

Area Verdict
Secret / credential exposure None introduced
Command injection via shell patterns No new vectors; unquoted env-var template is pre-existing and low-risk
Path traversal No user-controlled paths introduced
GitHub Actions (workflow files) No files changed
Supply-chain / dependency pins plugin.json version bump only; no new packages
Trust delegation (remote MCP, external scripts) None introduced
Logic / trust-boundary flaws in skill instructions None; saveVideo path correctly marked unverified; resize non-effect correctly documented

@kyle-sexton
kyle-sexton merged commit 541f0ac into main Jul 26, 2026
31 checks passed
@kyle-sexton
kyle-sexton deleted the fix/playwright-video-frame-size branch July 26, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant