fix: detect playwright-wire endpoints in connect() and sanitize connection errors

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable user-facing changes to Rustwright are documented in this file.
 
 ## [Unreleased]
 
+### Breaking
+
+- **Release target: 0.3.0.** `BrowserType.connect()` no longer forwards raw-CDP
+  endpoints to `connect_over_cdp()`. It now rejects every endpoint before
+  network I/O because Rustwright does not implement Playwright wire. Migrate
+  sync code from `chromium.connect(endpoint)` to
+  `chromium.connect_over_cdp(endpoint)`. Migrate async code from
+  `await chromium.connect(endpoint)` to
+  `await chromium.connect_over_cdp(endpoint)`. Services that use
+  `playwright run-server` or `BrowserType.launchServer()` must change to a raw
+  Chromium CDP service. See
+  [`docs/REMOTE_BROWSERS.md`](docs/REMOTE_BROWSERS.md).
+
 ### Changed
 
 - Reduced steady-state object-valued `evaluate()` results to one browser-protocol command after per-realm serializer setup; the first call in a new or recreated realm re-establishes that setup.

CONTRIBUTING.md

@@ -48,6 +48,13 @@ iterating:
 pytest tests/test_rustwright_sync_api.py -k "launch_goto_title_and_url or click_updates_dom or fill_sets_value_and_dispatches_events or frame_locator_scopes_locators_to_iframe_content"
 ```
 
+The connect test-support cases require a feature-enabled native extension:
+
+```bash
+maturin develop --features test-support
+pytest tests/test_rustwright_sync_api.py -k "test_connect_test_options_are_consumed_by_preflight_rejection or test_chromium_connect_over_cdp_wss_rejects_untrusted_private_ca or test_chromium_connect_over_cdp_wss_runs_complete_flow_without_http_discovery or test_chromium_connect_over_cdp_wss_rejects_incomplete_upgrade_response or test_browser_type_connect_unsupported_message_matrix or test_browser_type_connect_validation_precedes_unsupported_without_io or test_connect_boundary_counters_cover_public_http_discovery"
+```
+
 For a broader local smoke before opening a PR:
 
 ```bash

Cargo.toml

@@ -18,9 +18,15 @@ resolver = "2"
 [features]
 default = ["python"]
 python = ["dep:pyo3"]
-# Internal runtime-state probes for explicit test-wheel builds only.
+# Native connection probes, local CA injection, and internal runtime-state
+# probes for explicit test wheels only.
 # Default and release wheel builds must not enable this feature.
-test-support = ["python"]
+test-support = [
+    "python",
+    "dep:rustls",
+    "dep:rustls-pki-types",
+    "dep:webpki-roots",
+]
 
 [lib]
 name = "_rustwright"
@@ -36,8 +42,11 @@ serde_json = "1.0.127"
 libc = "0.2.186"
 tempfile = "3.8.1"
 thiserror = "2"
+rustls = { version = "0.23.41", default-features = false, features = ["ring", "std"], optional = true }
+rustls-pki-types = { version = "1.15.0", optional = true }
 tokio = { version = "1.52.3", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "sync", "time"] }
 tokio-tungstenite = { version = "0.29.0", features = ["rustls-tls-webpki-roots"] }
+webpki-roots = { version = "0.26.11", optional = true }
 
 [profile.release]
 lto = "fat"

LIMITATIONS.md

@@ -4,6 +4,12 @@ Rustwright is an alpha, not a complete Playwright replacement.
 
 - Chromium only. Firefox and WebKit entry points currently raise unsupported
   browser errors.
+- Playwright wire endpoints from `playwright run-server` and
+  `BrowserType.launchServer()` are unsupported. Remote Chromium requires raw
+  CDP through `chromium.connect_over_cdp()`. HTTP discovery can identify a
+  Playwright endpoint definitively. Direct WebSocket detection is heuristic
+  and can only report that the first reply resembles Playwright wire. See
+  [`docs/REMOTE_BROWSERS.md`](docs/REMOTE_BROWSERS.md).
 - Behavioral parity is not fully proven. Rustwright exposes a broad
   Playwright-shaped API, but API-surface coverage is not the same as complete
   browser behavior parity.

README.md

@@ -233,6 +233,12 @@ Rustwright drives browsers — but you still need somewhere to run them. Skyvern
 
 Each session returns a `browser_address` CDP endpoint that Rustwright connects to like any remote Chromium (sessions bill while open).
 
+Use `chromium.connect_over_cdp()` for every remote Chromium connection.
+`BrowserType.connect()` is not a CDP alias and does not support Playwright
+`run-server` endpoints. See the [remote-browser guide](docs/REMOTE_BROWSERS.md)
+for migration steps, endpoint diagnostics, security guidance, and the pinned
+Open WebUI compose recipe.
+
 **Get started:**
 
 1. Make an account at [app.skyvern.com](https://app.skyvern.com)

docs/PARITY.md

@@ -40,8 +40,8 @@ Legend: ✅ present and statically resolved in a registered parity case; 🟡 pr
 | `Playwright.stop` | method | 🟡 present, not exercised | 🟡 present, not exercised |
 | `Playwright.webkit` | property | 🟡 present, not exercised | 🟡 present, not exercised |
 | `PlaywrightContextManager.start` | method | 🟡 present, not exercised | 🟡 present, not exercised |
-| `BrowserType.connect` | method | 🟡 present, not exercised | 🟡 present, not exercised |
-| `BrowserType.connect_over_cdp` | method | ✅ present + exercised | 🟡 present, not exercised |
+| `BrowserType.connect` | method | 🟡 present, intentionally unsupported | 🟡 present, intentionally unsupported |
+| `BrowserType.connect_over_cdp` | method | ✅ present + exercised | ✅ present + exercised |
 | `BrowserType.executable_path` | property | ✅ present + exercised | 🟡 present, not exercised |
 | `BrowserType.launch` | method | ✅ present + exercised | 🟡 present, not exercised |
 | `BrowserType.launch_persistent_context` | method | ✅ present + exercised | 🟡 present, not exercised |