fix(mcp): implement signalToPromise dispose to remove abort listener

.claude/skills/playwright-dev/SKILL.md

@@ -14,5 +14,6 @@ See [CLAUDE.md](../../../CLAUDE.md) for monorepo structure, build/test/lint comm
 - [MCP Tools and CLI Commands](tools.md) — add MCP tools, CLI commands, config options
 - [Vendor Dependencies & Bundling](vendor.md) — utilsBundle, coreBundle, babelBundle; adding vendored npm packages; DEPS.list; `check_deps`
 - [Updating WebKit Safari Version](webkit-safari-version.md) — update the Safari version string in the WebKit user-agent
+- [WebView (iOS Safari) Backend](webview.md) — `webkit/webview/` against stock Mobile Safari; provisional-target pause/resume; what's upstream vs Playwright patches; local + CI test setup
 - [Bisecting Across Published Versions](bisect-published-versions.md) — reproduce regressions side-by-side from npm and diff `node_modules/playwright/lib/` between versions
 - [Dashboard](dashboard.md) - the UI powering the "playwright cli show" command, and how to work on it

.claude/skills/playwright-dev/library.md

@@ -145,10 +145,6 @@ Manages the client-server transport:
 | `Locator` | `locator.ts` | Delegates to `Frame` methods with selector + `strict: true` |
 | `ElementHandle` | `elementHandle.ts` | DOM element reference |
 
-### Public API Exports
-
-`packages/playwright-core/src/client/api.ts` exports all public classes.
-
 ## Server Layer
 
 ### SdkObject — Base Class

.claude/skills/playwright-dev/webview.md

@@ -0,0 +1,149 @@
+# WebView (iOS Safari) Backend Reference
+
+Notes for developing the **stock-Mobile-Safari** backend in
+[packages/playwright-core/src/server/webkit/webview/](../../../packages/playwright-core/src/server/webkit/webview/).
+The regular WebKit backend one level up (`webkit/`) runs against a
+Playwright-patched WebKit build; the `webview/` folder targets unmodified
+Safari on real iOS/iPadOS or the iOS Simulator over the standard Web Inspector
+Protocol.
+
+## What is and isn't available
+
+Stock Mobile Safari only exposes the upstream Web Inspector Protocol. Anything
+Playwright added to its forked WebKit is not available here.
+
+**Available** — methods/events in `Source/JavaScriptCore/inspector/protocol/*.json`
+on `browser_upstream/main`:
+
+```bash
+git -C ~/webkit show browser_upstream/main:Source/JavaScriptCore/inspector/protocol/<Domain>.json
+```
+
+**Not available** — anything added by the Playwright WebKit patches:
+
+```bash
+ls ~/playwright-browsers/browser_patches/webkit/patches/  # bootstrap.diff lives here
+```
+
+Quick provenance check for a symbol — in `~/webkit`:
+
+```bash
+git log --all -S "<symbol>" -- <path>
+```
+
+If every hit is a `chore(webkit): bootstrap build` commit, it's a Playwright
+patch. Some traps where the upstream name overlaps with a Playwright-only
+helper of similar intent:
+
+- `Target.setPauseOnStart` / `Target.resume` (**upstream**, gates loading of
+  provisional process-swap targets) vs `PageInspectorController::pauseOnStart`
+  / `resumeIfPausedInNewWindow` (**Playwright patch**, for `window.open`
+  popups). They sound the same; they aren't.
+- `Playwright.*` domain (cookies, navigate, all global controls) — entirely
+  Playwright. Use stock equivalents on the page session (e.g. `Page.getCookies`).
+- `Network.continueWithAuth`, intercepted-response body access via Network —
+  Playwright extensions.
+
+## Architecture
+
+This backend deliberately mirrors the regular WebKit backend one level up
+(`wkConnection.ts` / `wkPage.ts` / `wkProvisionalPage.ts`). When in doubt,
+read the WK equivalent — the WV class should look almost the same. The
+`outerSession` is the WV analogue of WK's page-proxy session.
+
+```
+WebSocketTransport (ws://localhost:9222/devtools/page/<n>, via ios_webkit_debug_proxy)
+  → WVConnection            — dumb transport; owns only outerSession
+      → WVConnection.outerSession (sessionId "")  — Target.sendMessageToTarget bridge
+          → WVPage          — owns per-target WVSessions, routes
+                              Target.dispatchMessageFromTarget, manages swaps
+              → _session (current) + WVProvisionalPage (during a swap)
+              → WVExecutionContext, WVWorkers, RawKeyboard/Mouse/Touchscreen
+                (all hold a session reference, all have setSession() for swap)
+```
+
+`WVConnection` is intentionally minimal: it pumps the transport into
+`outerSession` and back. `WVPage` creates the per-target `WVSession`s
+(`_createSession`), routes `Target.dispatchMessageFromTarget` by `targetId` to
+either `_session` or `_provisionalPage._session`, and handles
+`Target.targetCreated/targetDestroyed/didCommitProvisionalTarget` — exactly
+like `WKPage`. `WVPage` is constructed with the outer session (not a target
+session); `_session` starts undefined and is bound on the first
+`Target.targetCreated` via `_setSession`. `WVBrowser._attachTab` awaits
+`page.waitForInitialized()` (resolves after the first target is reported as
+new) instead of waiting on the connection.
+
+## Process swap / provisional targets
+
+Cross-origin navigation in an existing tab can make Mobile Safari spawn a new
+process. The protocol sequence is:
+
+```
+Target.targetCreated  targetInfo:{ isProvisional:true, isPaused:true }
+... events on the provisional target during the navigation ...
+Target.didCommitProvisionalTarget  oldTargetId, newTargetId
+Target.targetDestroyed  oldTargetId
+```
+
+Handling mirrors WK — `WVProvisionalPage` ≈ `WKProvisionalPage`, swapped in by
+`WVPage._onDidCommitProvisionalTarget`. The one essential trick:
+`Target.setPauseOnStart` (sent in `WVBrowser._attachTab`) makes provisional
+targets arrive `isPaused`, so `WVPage` can set up interception / bootstrap
+before resuming them with `Target.resume`; otherwise the new process races
+ahead and `page.route(...)` never fires.
+
+Not to be confused with the **popup-pause** path (`window.open`), which is a
+Playwright patch (`PageInspectorController::pauseOnStart`) with no stock-Safari
+equivalent.
+
+## Test infrastructure
+
+```
+tests/webview/
+  playwright.config.ts        — single project "webkit-webview-page", runs tests/page/
+  webviewTest.ts              — fixture: discovers tab via ios_webkit_debug_proxy /json,
+                                resets Mobile Safari between tests
+  expectations/
+    webkit-webview-page.txt   — `<test path> › <name> [fail|flaky|timeout|skip]`
+  expectationUtil.ts          — loader + skip-decision logic
+```
+
+`[fail]` entries cause `it.skip()` to fire before the test body runs — so a
+formerly-failing test that now passes won't be flagged automatically, you have
+to remove the line and re-run. The marker also has prefix-match semantics for
+`it.step` children.
+
+### Running locally
+
+```bash
+./utils/run_webview_tests.sh           # ensures ios_webkit_debug_proxy is up on 9222
+npm run wvtest -- -g "<test title>"    # single test
+npm run wvtest -- tests/page/foo.spec.ts
+DEBUG=pw:protocol npm run wvtest -- -g "<title>" > /tmp/log 2>&1
+```
+
+The simulator needs to be booted with one Mobile Safari tab. The script's only
+job is keeping a single
+`ios_webkit_debug_proxy -F -d -s unix:<socket> -c null:9221,:9222-9322` alive;
+everything else is done by the fixture.
+
+### Common local pitfalls
+
+- **Multiple `ios_webkit_debug_proxy` processes** — every protocol event is
+  delivered through each instance, so debug logs show events duplicated and
+  some tests flake. `pgrep -lf ios_webkit_debug_proxy` and clean up.
+- **Chrome bound to `127.0.0.1:9222`** — Chrome's `--remote-debugging-port=9222`
+  shadows iwdp's `*:9222` listener for traffic addressed to `localhost`.
+  Kill the Chrome instance (`lsof -nP -iTCP -sTCP:LISTEN | grep 9222`).
+- **Stale launchd socket** — `lsof -aUc launchd_sim` should show
+  `com.apple.webinspectord_sim.socket` for the currently booted simulator. If
+  iwdp was started against an older `launchd_sim` socket path it will silently
+  serve nothing.
+
+## CI
+
+[.github/workflows/tests_webview_simulator.yml](../../../.github/workflows/tests_webview_simulator.yml)
+runs the same suite on `macos-15` (booted iOS Simulator +
+`brew install ios-webkit-debug-proxy`). Triggers: `workflow_dispatch`, and
+`pull_request` only when paths under `tests/webview/**`, the `webview/` source
+folder, or the workflow file itself change.

.github/actions/run-test/action.yml

@@ -39,7 +39,6 @@ runs:
     - uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node-version }}
-    - uses: ./.github/actions/enable-microphone-access
     - run: |
         echo "::group::npm ci"
         npm ci

.github/actions/upload-blob-report/action.yml

@@ -14,7 +14,10 @@ runs:
   steps:
     - name: Integrity check
       shell: bash
-      run: find "${{ inputs.report_dir }}" -name "*.zip" -exec unzip -t {} \;
+      run: |
+        echo "::group::extracting blob archives"
+        find "${{ inputs.report_dir }}" -name "*.zip" -exec unzip -t {} \;
+        echo "::endgroup::"
     - name: Upload blob report to GitHub
       if: ${{ !cancelled() }}
       uses: actions/upload-artifact@v7

.github/workflows/tests_docker.yml

@@ -0,0 +1,131 @@
+name: tests docker
+
+on:
+  workflow_call:
+
+env:
+  FORCE_COLOR: 1
+
+jobs:
+  test_linux_docker:
+    name: "Docker ${{ matrix.docker_tag }} ${{ matrix.docker_arch }}"
+    environment: ${{ github.event_name == 'push' && 'allow-uploading-flakiness-results' || null }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - docker_tag: jammy
+          docker_arch: amd64
+          host_os: ubuntu-22.04
+        - docker_tag: jammy
+          docker_arch: arm64
+          host_os: ubuntu-22.04-arm
+        - docker_tag: noble
+          docker_arch: amd64
+          host_os: ubuntu-22.04
+        - docker_tag: noble
+          docker_arch: arm64
+          host_os: ubuntu-22.04-arm
+    runs-on: ${{ matrix.host_os }}
+    permissions:
+      id-token: write   # This is required for OIDC login (azure/login) to succeed
+      contents: read    # This is required for actions/checkout to succeed
+    steps:
+    - name: Create ~/.azure directory
+      run: mkdir -p ~/.azure
+    - uses: actions/checkout@v6
+    - uses: actions/setup-node@v6
+      with:
+        node-version: 22
+      env:
+        PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+    - run: npm ci
+    - run: npm run build
+    # Used as a Pull-through cache for the Docker images. Only available on the
+    # main repo, where the secrets are present; forks fall back to Docker Hub.
+    - name: Azure Login
+      if: ${{ github.event_name == 'push' && github.repository == 'microsoft/playwright' }}
+      uses: azure/login@v3
+      with:
+        client-id: ${{ secrets.AZURE_FLAKINESS_DASHBOARD_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_FLAKINESS_DASHBOARD_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_FLAKINESS_DASHBOARD_SUBSCRIPTION_ID }}
+    - name: Login to ACR via OIDC
+      if: ${{ github.event_name == 'push' && github.repository == 'microsoft/playwright' }}
+      run: az acr login --name playwright
+    - name: Add Dockerfile cache
+      if: ${{ github.event_name == 'push' && github.repository == 'microsoft/playwright' }}
+      run: sed -i 's/FROM ubuntu/FROM playwright.azurecr.io\/cached\/ubuntu/' utils/docker/Dockerfile.${{matrix.docker_tag}}
+    - run: ./utils/docker/build.sh --${{ matrix.docker_arch }} ${{ matrix.docker_tag }} playwright:localbuild
+      shell: bash
+    - name: Launch container
+      run: |
+        docker run \
+          --rm \
+          --name docker-tests \
+          --platform linux/${{ matrix.docker_arch }} \
+          --user=pwuser \
+          --workdir /home/pwuser \
+          --env CI \
+          --env INSIDE_DOCKER=1 \
+          -v ~/.azure:/root/.azure \
+          -d \
+          -t \
+          playwright:localbuild /bin/bash
+    - name: Copy repository inside docker container
+      run: |
+        # Note: we cannot do explicit `git clone` inside container because it requires some smarts to decide if github.sha or
+        # github.ref should be used for checkout.
+        # The actions/checkout action already handled this complexity for us, so we'll just copy checkout.
+        docker cp . docker-tests:/home/pwuser/playwright
+        docker exec --user root docker-tests chown -R pwuser /home/pwuser/playwright
+
+        # GIT is now picky on directory ownership
+        # See https://github.blog/2022-04-12-git-security-vulnerability-announced/
+        docker exec \
+          --user root \
+          --workdir /home/pwuser/playwright docker-tests /bin/bash -c '
+            git config --global --add safe.directory /home/pwuser/playwright
+          '
+    - name: Run "npm ci" inside docker
+      run: docker exec --workdir /home/pwuser/playwright docker-tests npm ci
+
+    - name: Run "npm run build" inside docker
+      run: docker exec --workdir /home/pwuser/playwright docker-tests npm run build
+
+    - name: "Run @smoke tests inside docker"
+      run: docker exec --workdir /home/pwuser/playwright docker-tests xvfb-run --auto-servernum --server-args="-screen 0 1280x960x24" npm run test -- --grep "@smoke"
+
+    - name: Azure Login
+      if: ${{ !cancelled() && github.event_name == 'push' && github.repository == 'microsoft/playwright' }}
+      uses: azure/login@v3
+      with:
+        client-id: ${{ secrets.AZURE_FLAKINESS_DASHBOARD_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_FLAKINESS_DASHBOARD_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_FLAKINESS_DASHBOARD_SUBSCRIPTION_ID }}
+    - name: Upload Flakiness dashboard
+      if: ${{ !cancelled() && github.event_name == 'push' && github.repository == 'microsoft/playwright' }}
+      run: |
+        # Flakiness dashboard has to be uploaded from-inside docker container so that it can collect meta information, e.g. arch
+        # See https://github.com/microsoft/playwright/blob/13b1e52d95df416fdfa7846c8a840aad8df263af/utils/upload_flakiness_dashboard.sh#L71-L86
+        docker exec \
+          --env GITHUB_REPOSITORY \
+          --env GITHUB_REF \
+          --env GITHUB_RUN_ID \
+          --user root \
+          --workdir /home/pwuser/playwright docker-tests /bin/bash -c '
+            set -e
+            # Azure-CLI is needed for upload_flakiness_dashboard.sh script.
+            curl -sL https://aka.ms/InstallAzureCLIDeb | bash
+            ./utils/upload_flakiness_dashboard.sh "./test-results/report.json"
+          '
+    - name: Copy blob report from container
+      if: ${{ !cancelled() && (github.event_name == 'pull_request' || failure()) }}
+      run: docker cp "docker-tests:/home/pwuser/playwright/blob-report" "./blob-report"
+
+    - name: Upload blob report
+      if: ${{ !cancelled() && (github.event_name == 'pull_request' || failure()) }}
+      uses: ./.github/actions/upload-blob-report
+      with:
+        report_dir: blob-report
+        job_name: docker-${{ matrix.docker_tag }}-${{ matrix.docker_arch }}

.github/workflows/tests_docker_changes.yml

@@ -0,0 +1,24 @@
+name: tests docker (changes)
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'utils/docker/**'
+      - '.github/workflows/tests_docker*.yml'
+  pull_request:
+    branches:
+      - main
+      - release-*
+    paths:
+      - 'utils/docker/**'
+      - '.github/workflows/tests_docker*.yml'
+
+jobs:
+  test_linux_docker:
+    uses: ./.github/workflows/tests_docker.yml
+    permissions:
+      id-token: write
+      contents: read
+    secrets: inherit

.github/workflows/tests_docker_release.yml

@@ -0,0 +1,14 @@
+name: tests docker (release)
+
+on:
+  push:
+    branches:
+      - release-*
+
+jobs:
+  test_linux_docker:
+    uses: ./.github/workflows/tests_docker.yml
+    permissions:
+      id-token: write
+      contents: read
+    secrets: inherit