Skip to content

chore(cli): copy package onto the V4 spike - #2522

Closed
shrey150 wants to merge 14 commits into
v4-spikefrom
v4-spike-cli
Closed

chore(cli): copy package onto the V4 spike#2522
shrey150 wants to merge 14 commits into
v4-spikefrom
v4-spike-cli

Conversation

@shrey150

@shrey150 shrey150 commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Summary

  • copy the existing CLI package into the V4 workspace
  • register it in the workspace build, format, lint, and typecheck graph
  • keep runtime imports on the existing stagehand-v3@3.7.1 alias so this baseline compiles and tests before any V4 migration begins
  • refresh the copied package to the published browse@0.9.6 behavior, changelog, bundled skill, and version
  • isolate the doctor and permission-hardening tests from machine-specific daemon/umask state
  • give the two eval CLI subprocess tests that load the full run planner enough time under concurrent CI load

Review boundary

This is the mechanical integration baseline. It intentionally preserves V3 runtime behavior. Child pull requests migrate one V4 concern at a time.

Refreshed on 2026-08-10 against the current parent and v4-spike commit d7556e9a.

E2E Test Matrix

Command / flow Observed output Confidence / sufficiency
2026-08-10 cumulative stack refresh on Chrome Stable 151 pnpm build passed 6/6 tasks; pnpm check passed 11/11 tasks with 0 errors; the full pnpm test graph exited 0, including 17/17 protocol browser tests and 15/15 local SDK browser tests Proves the updated six-PR stack is compatible with v4-spike d7556e9a across build, static checks, unit tests, and real-browser suites.
Clean coordinated-release tarball consumer at the cumulative tip Packed workspace Stagehand and Browse, installed both into an empty npm project, opened example.com, produced a snapshot, clicked through to IANA, filled an injected input, and read back published-v4-ok Proves the intended co-published artifacts work outside the monorepo with a real Chrome session; it does not substitute for a credentialed Browserbase smoke.
Exact Node 24.18.0 + pnpm 11.10.0 frozen install Lockfile supply-chain verification passed for 1,657 entries Proves the refreshed baseline installs reproducibly with the repository-declared toolchain.
Eval CLI subprocess regression, repeated three times 61/61 tests passed in each run Reproduces the CI-sensitive file and verifies the targeted 20-second per-test allowance without weakening assertions.
Exact CI JavaScript unit command on this branch 12/12 tasks passed; 1,760 tests passed and 10 todos Covers the full workspace under the same concurrent Turbo command that previously exposed the five-second timeout.
corepack pnpm --filter browse test:unit on this branch 25 files passed; 366/366 tests passed Covers the copied CLI, published 0.9.6 daemon fixes, log reducer hardening, command contracts, and the umask-safe permission regression.
corepack pnpm build on this branch 6/6 build tasks passed Proves the refreshed baseline compiles in the current V4 workspace graph.
corepack pnpm check on this branch 10/10 tasks passed; 399 warnings and 0 errors Proves formatting, lint, typecheck, and docs validation pass at this layer.
Final-stack npm artifact comparison against browse@0.9.6 Identical 142-file package list, exact 70-command oclif manifest, identical bundled skill, identical --help, and version 0.9.6 Proves the refreshed stack preserves the published CLI surface and package contents apart from the intentional V4 runtime dependency/code.

No changeset is included because this pull request integrates already-published CLI behavior and preserves the runtime contract.

Final release validation (2026-08-10)

At the cumulative stack tip:

  • release validation now recognizes public browse changesets
  • a Changesets version dry run resolves browse 0.9.7, Stagehand 4.0.1, extension 1.0.1, and Go 4.0.1
  • the packed Browse 0.9.7 manifest rewrites workspace:* to exact Stagehand 4.0.1
  • a clean npm consumer installed those versioned tarballs and completed real-Chrome open, snapshot, model-free click, URL read, and stop with zero audit vulnerabilities

@changeset-bot

changeset-bot Bot commented Jul 30, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a90cd0d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Jul 30, 2026

Copy link
Copy Markdown

@socket-security

socket-security Bot commented Jul 30, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/oclif@4.23.29npm/@pnpm/network.ca-file@1.0.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

shrey150 and others added 9 commits August 9, 2026 21:38
- translate daemon socket `ECONNREFUSED` and `ENOENT` failures into a
human-readable error
- print the exact `browse open` command that restarts the requested
session
- document that API keys are forwarded to an already-running daemon and
that `browse stop` is idempotent
- preserve regression coverage for late environment variables and
exit-code-zero cleanup

The daemon client passed raw Unix socket errors through to users when
the daemon disappeared between the readiness check and the request.
Agents received `ECONNREFUSED` without a recovery command.

Agents now get an actionable `daemon_not_running` failure with the exact
command needed to restart the session. Recovery command arguments are
shell-quoted, and a daemon disappearing between status and stop is
treated as an already-stopped session. Cleanup synchronizes with daemon
startup so it preserves a replacement daemon that starts during the stop
race. The bundled SKILL.md also makes the already-fixed env timing and
stop behavior explicit.

| Command / flow | Observed output | Confidence / sufficiency |
| --- | --- | --- |
| `pnpm --filter browse build` | TypeScript compilation and oclif
manifest generation completed successfully. | Proves the exact local CLI
code under review builds; does not exercise a live browser. |
| `pnpm --filter browse test:cli` | 25 test files passed; 366/366 tests
passed. This includes deterministic daemon disappearance/restart races,
adversarial recovery-command shell quoting, malformed CDP log payloads,
and the complete CLI contract suite. | Proves the full CLI suite passes
against the completed local build on macOS; GitHub CI provides the
Ubuntu/Windows matrix. |
| `BROWSE_DAEMON_DIR=<temp dir> node packages/cli/bin/run.js stop
--session no-daemon-smoke` | Exited `0` and printed `{ "stopped": false,
"session": "no-daemon-smoke" }`. | Exercises the built CLI's real
absent-daemon stop path and confirms its documented successful no-op
behavior. |
| `pnpm --filter browse lint` | Full-package Prettier, ESLint, and
TypeScript checks completed successfully. | Reproduces the CI lint
pipeline locally and verifies the daemon changes, log reducer, tests,
and inherited CLI lint baseline. |

Linear:
[GRO-1908](https://linear.app/browserbase/issue/GRO-1908/cli-namespace-2027-dev-suggested-docs-updates)

<!-- This is an auto-generated description by cubic. -->
---
Replaces raw socket errors with a clear `daemon_not_running` message and
prints the exact, shell-quoted `browse open` recovery command. `browse
stop` now treats a missing daemon as already stopped, validates
ownership before cleanup, and avoids tearing down a daemon that restarts
mid-race. Addresses Linear:
https://linear.app/browserbase/issue/GRO-1908/cli-namespace-2027-dev-suggested-docs-updates.

- **Bug Fixes**
- Map `ECONNREFUSED`/`ENOENT` to `daemon_not_running` and show the
precise, session-aware recovery command.
- Make `browse stop` idempotent and safe: if the daemon vanished (no
`--force`), return `{ stopped: false }`; acquire a lock and verify
daemon ownership before removing pid/socket/lock; preserve a replacement
daemon started during the stop race (handles PID reuse).
- Harden CDP log reduction: stricter parsing, ignore malformed payloads,
and require numeric response statuses.
- Docs: clarify `BROWSERBASE_API_KEY` is forwarded on every command and
`browse stop` is idempotent; add troubleshooting for the new error.
- Tests: cover the error message and shell-quoted recovery command
(round-tripped through `/bin/sh`), stop race cleanup and restart
preservation, PID reuse, and reduce-logs edge cases.

<sup>Written for commit 030c02a.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/browserbase/stagehand/pull/2356?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

---------

Co-authored-by: Shrey Pandya <shrey@browserbase.com>
Prepare the next browse release by versioning the package on `main`.

What this PR does:
- bumps `packages/cli/package.json` to `0.9.6`
- updates the browse changelog
- consumes the pending browse changesets

After this PR merges, the `Release` workflow on `main` will publish
`browse@0.9.6` from that exact commit using `pnpm pack` + `npm publish
--provenance`.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@shrey150

Copy link
Copy Markdown
Contributor Author

Superseded by the clean replacement stack. The normalized Browse 0.9.6 import is now #2833, based on the Stagehand foundation PRs #2831 and #2832. Runtime migration behavior is intentionally isolated in #2834. Closing this draft in favor of those reviewable layers.

@shrey150 shrey150 closed this Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants