feat: add --(allowed|blocked)-origins (#319)

Useful to limit the agent when using the playwright-mcp server with an
agent in auto-invocation mode.

Not intended to be a security feature.

src/config.ts

@@ -36,6 +36,8 @@ export type CLIOptions = {
   host?: string;
   vision?: boolean;
   config?: string;
+  allowedOrigins?: string[];
+  blockedOrigins?: string[];
   outputDir?: string;
 };
 
@@ -50,6 +52,10 @@ const defaultConfig: Config = {
       viewport: null,
     },
   },
+  network: {
+    allowedOrigins: undefined,
+    blockedOrigins: undefined,
+  },
 };
 
 export async function resolveConfig(cliOptions: CLIOptions): Promise<Config> {
@@ -110,6 +116,10 @@ export async function configFromCLIOptions(cliOptions: CLIOptions): Promise<Conf
     },
     capabilities: cliOptions.caps?.split(',').map((c: string) => c.trim() as ToolCapability),
     vision: !!cliOptions.vision,
+    network: {
+      allowedOrigins: cliOptions.allowedOrigins,
+      blockedOrigins: cliOptions.blockedOrigins,
+    },
     outputDir: cliOptions.outputDir,
   };
 }
@@ -171,5 +181,9 @@ function mergeConfig(base: Config, overrides: Config): Config {
     ...pickDefined(base),
     ...pickDefined(overrides),
     browser,
+    network: {
+      ...pickDefined(base.network),
+      ...pickDefined(overrides.network),
+    },
   };
 }