Merge pull request #178 from openqj/feat-playwright-mcp

feat: 浏览器自动化 MCP（Playwright）

cloud/worker.py

@@ -177,6 +177,8 @@ from cloud.websearch import ensure_codex_home_websearch as _ensure_websearch_mcp
 from cloud.websearch import ensure_websearch_mcp_env as _ensure_websearch_mcp_env
 from cloud.imagegen import ensure_codex_home_imagegen as _ensure_imagegen_mcp
 from cloud.imagegen import ensure_imagegen_mcp_env as _ensure_imagegen_mcp_env
+from cloud.playwright_browser import ensure_codex_home_playwright as _ensure_playwright_mcp
+from cloud.playwright_browser import ensure_playwright_mcp_env as _ensure_playwright_mcp_env
 from cloud.skill_seed import ensure_codex_home_skills as _ensure_skills
 from cloud.sub2api import gateway_name as _gateway_name
 from cloud.sub2api import gateway_origin as _gateway_origin
@@ -425,7 +427,7 @@ class Worker:
                  tenant_template_home=None, tenant_template_repo=None,
                  egress_proxy_port=0, claim_executor_only=False,
                  websearch_mcp=False, seed_skills=False,
-                 imagegen_mcp=False,
+                 imagegen_mcp=False, playwright_mcp=False,
                  host_name=None, pr_jobs_only=False,
                  upload_dir=None,
                  digest_interval_seconds=3600,
@@ -588,6 +590,15 @@ class Worker:
         # 未配 IMAGE_GEN_API_KEY 时工具会明确报错“未配置”，
         # 不会静默回退到任务自己的分组 2 key（那会 404）。
         self.imagegen_mcp = bool(imagegen_mcp)
+        # 浏览器自动化 MCP：默认关（老行为不变）。开启后
+        # _tenant_dirs 在 imagegen 播种之后调用 playwright 的
+        # 播种助手，把 playwright_browser.py / playwright_mcp.py
+        # 拷进租户 codex-home 并追加 [mcp_servers.playwright]；
+        # _prepare_tenant 在容器启动前写 [mcp_servers.playwright.env]
+        # （代理 + PLAYWRIGHT_BROWSERS_PATH，MCP 子进程不继承
+        # Codex 进程 env，所以镜像里的 ENV 在这里必须重写一遍）。
+        # 浏览器二进制在镜像里，不在 codex-home 里。
+        self.playwright_mcp = bool(playwright_mcp)
         # 技能播种：默认关（老行为：租户 codex-home 只有模板
         # config.toml + 可选的 websearch MCP）。开启后
         # _tenant_dirs 在 websearch 播种之后调用 skill_seed
@@ -2616,6 +2627,17 @@ class Worker:
                     "python3",
                     "/var/lib/codex-app-server/codex-home/"
                     "imagegen_mcp.py"])
+        if self.playwright_mcp:
+            # 与 imagegen 同款：播种失败直接抛错、任务不派发
+            # ——静默无浏览器比 loud 失败更糟，尤其对已宣传
+            # “能开浏览器”的任务。代理与浏览器路径由
+            # _prepare_tenant 的 env 块给。
+            _ensure_playwright_mcp(
+                dirs["codex_home"],
+                command_args=[
+                    "python3",
+                    "/var/lib/codex-app-server/codex-home/"
+                    "playwright_mcp.py"])
         if self.seed_skills:
             # 技能播种失败绝不阻塞任务：技能是可选的流程
             # 说明，不是 websearch 那种“已宣传就必须有”的
@@ -3066,6 +3088,23 @@ class Worker:
             except Exception as exc:
                 self.logger.warning(
                     "imagegen MCP env write failed: %s" % exc)
+        if self.tenant_isolation and self.playwright_mcp:
+            # 浏览器 MCP env：代理（Chromium 显式走 egress 代理，
+            # 不在白名单的域名会 403）+ 浏览器路径。MCP 子进程
+            # 不继承 Codex 进程 env，所以镜像里的
+            # PLAYWRIGHT_BROWSERS_PATH 在这里必须重写一遍；
+            # 不写的话容器用户无家目录，Playwright 会去
+            # /.cache 找浏览器而报 Executable doesn't exist。
+            try:
+                playwright_env = dict(proxy_env or {})
+                playwright_env["PLAYWRIGHT_BROWSERS_PATH"] = (
+                    "/opt/ms-playwright")
+                home = self._tenant_dirs(
+                    task.get("project_id"))["codex_home"]
+                _ensure_playwright_mcp_env(home, playwright_env)
+            except Exception as exc:
+                self.logger.warning(
+                    "playwright MCP env write failed: %s" % exc)
         return (True, tenant_mounts, tenant_network, proxy_env, None)
 
     def _run_fork(self, task, quota_check=None):
@@ -6553,6 +6592,13 @@ def main(argv=None):
                              " IMAGE_GEN_API_KEY + 代理 + NO_PROXY）；"
                              "默认关，老租户不受影响；未配 key 时工具"
                              "明确报未配置，不回退任务自己的网关 key")
+    parser.add_argument("--playwright-mcp", action="store_true",
+                        help="租户 codex-home 自动播种浏览器自动化 MCP："
+                             "_tenant_dirs 追加 [mcp_servers.playwright] 并拷入"
+                             " playwright_browser.py / playwright_mcp.py，"
+                             "_prepare_tenant 写 [mcp_servers.playwright.env]"
+                             "（代理 + PLAYWRIGHT_BROWSERS_PATH）；"
+                             "默认关，老租户不受影响；浏览器二进制在镜像里")
     parser.add_argument("--task-timeout", type=float, default=1800,
                         help="每任务截止时间（秒，默认 1800）；0 表示不限时"
                              "（与 host --turn-timeout 0 同约定，worker 级"
@@ -6616,7 +6662,8 @@ def main(argv=None):
                     claim_executor_only=args.claim_executor_only,
                     websearch_mcp=args.websearch_mcp,
                     seed_skills=args.seed_skills,
-                    imagegen_mcp=args.imagegen_mcp)
+                    imagegen_mcp=args.imagegen_mcp,
+                    playwright_mcp=args.playwright_mcp)
     # CLI 启动清理兜底（常驻与单次都做）：清掉上一轮残留容器。
     worker.cleanup_stale_containers()
     # CLI 起 worker 前先建表/迁移：全新库直接起循环不应因缺表而炸。