[DOCS/BUG] Browser automation tools (Playwright/Puppeteer) incompatible with web sandbox proxy

Adding my use case: I want cloud agents to test preview deployments (e.g., Vercel previews) using Browserbase/Stagehand before committing. Even though Browserbase runs browsers remotely, agents still need WebSocket/CDP connections to control them - which gets blocked by the current proxy. This workflow works locally but not in web sessions, which defeats the purpose of autonomous cloud agents.

In fact very important issue. Does anyone has an elegant workaround?

I'm unable to run my automated Playwright tests in the sandbox, despite excluding the commands used.

I'm going to have to stop using the sandbox for this atm, which means my alternatives are either more dangerous, or more annoying.

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

It's a critical issue we need a fix or a workaround or get it documented atleast.

Would be great to have this.

We hit this exact problem running Playwright E2E tests in Claude Code's web sandbox and found a working set of workarounds. Sharing the strategy and key discoveries — the specifics will vary by framework, but the pattern is universal.

My main motivation was to allow Claude Code to build, and validate E2E tests when running in the cloud to make it easier to run 10s of high quality concurrent sessions. I also have it take screenshots with read file to inline into the chat, and post images to embed into the PRs for quick review.

After a lot of trial and error, Claude found a workaround that lets Playwright tests run against a localhost dev server, including loading external resources (fonts, CDNs, APIs). This also installs Chromium since I needed the latest version to match my Playwright version vs the pre-installed versions.

While it fixed my issue, _the facts may not be completely right, as Claude cooked up the summary below_ of its own workaround. Initially it did brute force a ton of options in, but I then had it test all combinations to figure out what was really needed to reduce the noise on flags that weren't impactful.

-----

The Core Insight

The browser can't reach the internet, but Node.js can (via the egress proxy). Playwright's page.route() API lets you intercept requests at the network layer before Chromium tries to resolve DNS. So the strategy is: intercept external requests in Playwright, re-fetch them through Node.js using undici.ProxyAgent, and hand the response back to the browser.

Browser request → page.route() intercept → Node.js fetch (via ProxyAgent) → Egress proxy → Internet
                                                         ↓
                                                  Response back to browser

This means your tests run against a localhost dev server, with external resources (fonts, CDN scripts, API calls) transparently proxied through Node.js.

The Three Things You Need

1. A Playwright route interceptor

Use page.route() to match all non-localhost URLs. In the handler, fetch the URL using undici.ProxyAgent pointed at process.env.HTTPS_PROXY, strip hop-by-hop headers, and route.fulfill() with the response. Wire this into a custom Playwright fixture so every test gets it automatically.

2. A Node.js proxy bootstrap for your dev server

Node 22's built-in fetch() (undici) does not honor HTTP_PROXY/HTTPS_PROXY env vars by default. If your dev server makes any server-side fetches (SSR, API routes, font loading), they'll fail with EAI_AGAIN. Fix this with a small preload script that calls undici.setGlobalDispatcher(new EnvHttpProxyAgent()), loaded via NODE_OPTIONS="--require ./proxy-bootstrap.cjs" in your Playwright config's webServer.env.

3. A no_proxy override for playwright install

The container sets no_proxy=*.googleapis.com,*.google.com,... by default, which tells Node.js "bypass the proxy for these domains and connect directly." But DNS is completely broken without the proxy, so "connect directly" = EAI_AGAIN.

Playwright downloads Chromium from cdn.playwright.dev → redirects to storage.googleapis.com → matches the *.googleapis.com exclusion → bypasses proxy → DNS fails.

The fix: override no_proxy to just localhost when installing:

no_proxy="localhost" npx playwright install chromium

Important details:

• Only lowercase no_proxy matters. Both undici and proxy-from-env (Playwright's library) prefer lowercase over uppercase NO_PROXY. Setting only uppercase does nothing when lowercase is already set.
• no_proxy="localhost" is sufficient — no need for 127.0.0.1.
• Blank no_proxy="" doesn't work — empty string is falsy in JS, so no_proxy || NO_PROXY falls through to the uppercase default which still has *.googleapis.com.
• npx playwright test may not need this override if your Playwright config injects the proxy bootstrap via NODE_OPTIONS into the dev server process (it sets no_proxy internally).

Playwright Config Tips

• Launch Chromium with args: ['--no-proxy-server'] so the browser doesn't try to use the proxy itself (your route interceptor handles it at the application level).
• In your webServer config, keep proxy env vars for the dev server process (it needs them to reach external APIs), but inject the proxy bootstrap via NODE_OPTIONS.
• Always use pnpm exec playwright (or npx playwright) — never the bare playwright command. The container has a globally installed version that may not match your project's @playwright/test, causing "browser not found" errors.

Google Fonts Gotcha

If your app uses Google Fonts, they'll 403 from this environment — Google blocks requests from datacenter/proxy IPs. Bunny Fonts is a privacy-focused, open-source font CDN that mirrors the Google Fonts API with identical URL structure — same query params, same CSS format, same font files. It's a one-line URL rewrite away: swap fonts.googleapis.com → fonts.bunny.net in your route interceptor. Also rewrite URLs inside CSS response bodies, since Google Fonts CSS contains embedded url() references pointing back to fonts.gstatic.com for the actual font files.

Quick Start

# 1. Install project deps
npm install

# 2. Install Chromium (only step that needs no_proxy override)
no_proxy="localhost" npx playwright install chromium

# 3. Run tests (no override needed if config injects proxy bootstrap)
npx playwright test

Limitations

• Localhost only for top-level navigation. Your app must run as a dev server. You can't page.goto('https://example.com') directly — the interceptor proxies sub-resources loaded by the page.
• WebSocket connections to external hosts require a more involved CONNECT tunnel through Node.js (doable but more complex).
• Bare playwright screenshot of external URLs won't work without additional plumbing.

This pattern — page.route() + undici.ProxyAgent + no_proxy override — has been reliable for us running a full Nuxt + Playwright E2E suite in the sandbox. Hope it unblocks others hitting this wall.

Weirdly this was working on June 19 and 22. It was working earlier today, then suddenly stopped and Chrome started hitting net::ERR_CONNECTION_CLOSED.

This is one of three issues documenting the same underlying gap (with #15583 and #73564): there's no way to run a browser in Claude Code cloud sessions, DIY or otherwise.

I've filed the feature-level ask at #75632. It proposes an opt-in, pre-installed headless Chromium scoped to localhost first, which sidesteps the CONNECT tunneling limitation described here entirely: verifying a dev server inside the sandbox never touches the egress proxy. External browsing is framed as a separate phase 2 given the security trade-offs you'd rightly flag with CONNECT support.

If browser verification in cloud sessions matters to your workflow, a 👍 over there helps it get triaged.