Playwright synthetic monitoring

Prepare the sandbox

From the repository root, build the image and select it for your CLI or MCP process. doctor checks Docker and image availability without running a browser.

docker build -t telesis-playwright:dev backend/sandbox/playwright
export PLAYWRIGHT_SANDBOX_IMAGE=telesis-playwright:dev
telesis doctor --output=json

Write a native Playwright test

Imports, fixtures, hooks, locators, assertions, and TypeScript syntax are supported through @playwright/test. Relative navigation resolves against the monitored service URL.

import { test, expect } from '@playwright/test';

test('homepage is usable', async ({ page }) => {
  await page.goto('/');
  await expect(page.getByRole('heading').first()).toBeVisible();
});

Execute and inspect the result

The result includes individual test outcomes, duration, bounded console output, and available failure screenshots. Empty and entirely skipped suites cannot establish availability and fail the check.

• One worker, no retries, and a hard 120-second execution cap.
• Read-only container filesystem, non-root user, resource limits, and container cleanup on cancellation.
• Network access is enabled by default. Add --config='{"network_access":false}' to disable it.

telesis check https://your-service.example --type=playwright --mode=local \
  --script=smoke.spec.ts --timeout=60s --output=json

Check an authenticated journey

Read process.env.TELESIS_TEST_EMAIL and process.env.TELESIS_TEST_PASSWORD inside a trusted script. Inject only the named variables from the CLI environment. Adjust login selectors and cookie assertions for your application.

• Literal secret values are redacted from result text. Screenshots, video and traces are omitted when named secrets or storage state are supplied, unless you explicitly enable --allow-sensitive-artifacts.
• Redaction cannot prevent a script from deliberately transforming or transmitting a secret.
• Local secret injection is not yet available for saved scheduled scripts. The current Kubernetes chart does not provision a Docker sandbox worker.

telesis check https://your-service.example --type=playwright --mode=local \
  --script=login.spec.ts --secret-env=TELESIS_TEST_EMAIL \
  --secret-env=TELESIS_TEST_PASSWORD --timeout=60s --output=json

Reuse an authenticated session

Pass a Playwright storage-state JSON file with --storage-state=/private/path/session.json. Cookies and local storage are loaded into each fresh browser context. Keep the file out of source control and regenerate it when the session expires. Telesis does not automatically refresh sessions or bypass MFA.

For HTTP Basic authentication or bearer tokens, configure Playwright httpCredentials or extraHTTPHeaders in a trusted script using named TELESIS_TEST_* variables. Credentials belong in your process environment or private session file, not in saved script source.

Inspect video, traces and a local report

Recordings are optional. Export a private HTML report with test outcomes, console output, screenshots, playable video, downloadable traces and the script SHA-256. Open index.html in the new run directory. To inspect a trace without uploading it, run npx playwright show-trace with the downloaded ZIP path.

Authenticated recordings may contain private page data, cookies and network headers. Add --allow-sensitive-artifacts only when that capture is intended; literal text redaction does not redact pixels or trace archives.

• At most 6 attachments, 1 MiB per file and 2 MiB combined. Oversized or unavailable artifacts produce warnings while preserving test outcomes.
• The console is bounded to 64 KiB; the first 100 test details are retained and counts include all tests.
• The hard wall-clock timeout includes startup and cleanup; the test runner reserves six seconds for finalization. Very short timeouts may end before artifacts can be recovered.
• Local results stay local unless --save-to-check is supplied. Uploads save outcomes and artifacts to an existing Playwright check; its service URL must match the run. Uploads require write access and do not change the schedule.

telesis check https://your-service.example --type=playwright --script=smoke.spec.ts --record-video --record-trace --artifacts-dir=./private-reports --timeout=60s

Save runs and retrieve private artifacts

Add --save-to-check=CHECK_ID to persist a run, including failures. The response contains saved_result_id. Video, traces and PNG screenshots are stored separately from result summaries, with stable IDs, byte sizes, SHA-256 checksums and a seven-day retention deadline. Only members of the check’s organization can retrieve them.

The API provides CheckResultService.SavePlaywrightRun and GetCheckResultArtifact. Submit run_id to make retries idempotent; keep it unchanged when retrying the same payload. Result lists and detail responses carry artifact metadata, while GetCheckResultArtifact returns the individual file as bytes (base64 in Connect JSON). Files expire independently of any longer-lived result summary.

Saved local runs appear in the check’s history and availability statistics as local-upload. They do not trigger the scheduled-run alert pipeline or change the next scheduled run. Credential/session inputs are not uploaded; recordings may still contain private page data if you enabled sensitive capture.

• Storage accepts up to 10 files, 1 MiB each and 3 MiB combined, including screenshots. Runtime recording limits still apply.
• Expired and unavailable artifacts show a clear state; private files are never linked through public status pages.
• MCP run_check accepts save_to_check. get_check_result_artifact accepts result_id, artifact_id and output_dir, verifies the checksum, and returns a private local file path.

telesis check https://your-service.example --type=playwright --script=smoke.spec.ts --record-video --record-trace --save-to-check=CHECK_ID --artifacts-dir=./private-reports --timeout=60s
telesis monitor result RESULT_ID
telesis monitor artifact RESULT_ID ARTIFACT_ID --output-dir=./downloads
# Retry a previously exported run without executing it again
telesis monitor upload CHECK_ID ./private-reports/run-EXAMPLE/result.json

Update scripts and track their results

Use Edit Check Configuration in the dashboard to change script source, viewport, network access, recording options and schedule. Each new result identifies its script revision with SHA-256. Existing result history remains associated with the same check. History pages contain summaries; opening a result loads test details and artifact metadata. Preview and download controls fetch private files on demand.

The CLI monitor commands and MCP get_check, update_playwright_script, list_check_results and get_check_result tools support saved scripts and persisted history. Updating a script preserves its other settings and does not provision a hosted runner.

telesis monitor get CHECK_ID
telesis monitor update-script CHECK_ID smoke.spec.ts
telesis monitor results CHECK_ID --limit=20
telesis monitor result RESULT_ID