Commit d1c4e5bec for llama.cpp

commit d1c4e5bec1db1aa7feb2ee62a290e16d14b5c85a
Author: Aleksander Grygier <aleksander.grygier@gmail.com>
Date:   Tue Nov 3 19:02:54 2026 +0100

    ui: run local browser tests in installed Chrome with its sandbox on (#31596)

    Playwright's bundled Chromium lags behind Chrome security releases
    (1.56.1 ships 141, and even 1.64.1 ships 156.0.8078.4, before the
    156.0.8078.73 fixes), and Playwright launches it with --no-sandbox by
    default. Outside CI, use the installed, auto-updated Chrome with the
    sandbox enabled. CI keeps the bundled Chromium, so the self-hosted
    runner's preinstalled 1.56.1 browsers still work.

    Assisted-by: Claude (Opus 5.5 Medium)

diff --git a/tools/ui/README.md b/tools/ui/README.md
index c6ec54721..5db75128c 100644
--- a/tools/ui/README.md
+++ b/tools/ui/README.md
@@ -710,6 +710,8 @@ npm run test:server   # Server-side unit tests
 npm run test:ui       # Storybook visual tests
 ```

+Locally, the browser tests (e2e, client and Storybook) run in your installed Google Chrome with its sandbox on, since Chrome updates itself and Playwright's bundled Chromium lags behind security fixes. CI (`CI` set) uses the bundled Chromium from `npx playwright install`.
+
 ### Storybook Development

 ```bash
diff --git a/tools/ui/playwright.config.ts b/tools/ui/playwright.config.ts
index 057ed416d..2b6dde6cc 100644
--- a/tools/ui/playwright.config.ts
+++ b/tools/ui/playwright.config.ts
@@ -9,7 +9,12 @@ export default defineConfig({
 	projects: [
 		{
 			name: 'chromium',
-			use: { ...devices['Desktop Chrome'] }
+			use: {
+				...devices['Desktop Chrome'],
+				// locally, the installed (auto-updated) Chrome with its sandbox on: the bundled
+				// Chromium lags behind security fixes and Playwright disables its sandbox by default
+				...(process.env.CI ? {} : { channel: 'chrome', launchOptions: { chromiumSandbox: true } })
+			}
 		}
 	],
 	reporter: 'line',
diff --git a/tools/ui/vite.config.ts b/tools/ui/vite.config.ts
index 233ba7452..b213ec8ab 100644
--- a/tools/ui/vite.config.ts
+++ b/tools/ui/vite.config.ts
@@ -17,10 +17,12 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const browserBaseConfig: any = {
 	enabled: true,
 	instances: [{ browser: 'chromium' }],
+	// CI runs the bundled Chromium without its sandbox, which the runners can't start;
+	// locally, the installed (auto-updated) Chrome with its sandbox on, see playwright.config.ts
 	provider: playwright({
-		launchOptions: {
-			args: ['--no-sandbox']
-		}
+		launchOptions: process.env.CI
+			? { args: ['--no-sandbox'] }
+			: { channel: 'chrome', chromiumSandbox: true }
 	})
 };