[Bug]: Browser plugin — ignoreHTTPSErrors and bypassCSP are set in two places and applied in neither

What Happened

In pestphp/pest-plugin-browser (5.x), both ignoreHTTPSErrors and bypassCSP get set in the client, but neither reaches a Playwright API that takes them. So neither is actually on.

Client::connectTo() puts them in the websocket launch-options query. The server runs that through filterLaunchOptions(), which is a whitelist: channel, args, ignoreAllDefaultArgs, ignoreDefaultArgs, timeout, headless, proxy, chromiumSandbox, firefoxUserPrefs, slowMo, executablePath, downloadsPath, artifactsDir. Neither one's in there, so headless makes it through and the other two get dropped.

BrowserFactory::launch() sends them as BrowserType.launch params instead. scheme.BrowserTypeLaunchParams doesn't have either, and tObject builds its result by walking the schema's keys — so anything it doesn't know about just disappears, no error. (ignoreHttpsErrors there has a lowercase t as well, where Playwright writes ignoreHTTPSErrors. Doesn't matter, the key gets dropped either way.)

The place Playwright does take them is Browser.newContext; scheme.BrowserNewContextParams has both. The plugin's only newContext() call sits in PendingAwaitablePage::buildAwaitablePage() and passes locale, timezoneId, colorScheme, the device context and the user's options. Neither of these.

Fix is probably just moving both into the newContext() options and dropping them from the two launch paths.

How to Reproduce

I should be straight about this: I found it by reading the code on both sides, not by hitting it in a suite. So here's how to check the claim rather than a failing test.

In the plugin, grep -rn 'ignoreHTTPSErrors\|ignoreHttpsErrors\|bypassCSP' src/ returns exactly three lines — two in Client.php, one in BrowserFactory.php, and nothing in the newContext() call.

In node_modules/playwright-core/lib/coreBundle.js, filterLaunchOptions() shows the whitelist, scheme.BrowserTypeLaunchParams shows neither key, scheme.BrowserNewContextParams shows both, and tObject shows unknown keys being dropped without an error.

What I'd expect at runtime, though I haven't run it: visit() against an HTTPS host whose certificate the browser doesn't trust should die on the certificate, which is the thing ignoreHTTPSErrors is there to prevent. Nothing in the plugin's suite would catch it either way — the one HTTPS test hits https://example.com, which has a valid cert.

For bypassCSP I couldn't work out what it would break at all. Playwright pushes addInitScript and evaluate through CDP, and page CSP doesn't touch those. It's set, it doesn't arrive, and I don't know whether anything cares.

Pest Version

pestphp/pest-plugin-browser at 5.x (composer requires pestphp/pest: ^5.0.4), with the pinned playwright: ^1.62.1. Verified against playwright-core@1.62.1 sources.

PHP Version

8.4+ (the plugin requires ^8.4); this is protocol-level and doesn't depend on the PHP version.

Operation System

Not platform-specific — the options are dropped by the Playwright server's own option filter and protocol validator, so it happens the same everywhere.

Start with the three reported entry points: Client::connectTo(), BrowserFactory::launch(), and PendingAwaitablePage::buildAwaitablePage(). Trace how the two options are filtered or serialized, then verify that both are passed to Browser.newContext and removed from the launch paths. Use the reported grep command and inspect the existing browser tests; done means the options reach the context API without breaking current behavior.