Migrate all Stagehand templates to V4 - #101
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
shrey150
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 438ba1c. Configure here.
| }, | ||
| const browser = await browserbase.launch({ | ||
| apiKey: process.env.BROWSERBASE_API_KEY!, | ||
| api_timeout: 900, |
There was a problem hiding this comment.
Wrong launch timeout option name
Medium Severity
browserbase.launch now sets api_timeout instead of timeout. Other V4 launch calls use camelCase session fields like apiKey and browserSettings, and the Python pickleball template still passes timeout=900 for a 15-minute Browserbase session. This property is unused elsewhere, so the intended session lifetime is no longer applied to the long booking flow.
Reviewed by Cursor Bugbot for commit 438ba1c. Configure here.
There was a problem hiding this comment.
No code change needed: this is a false positive against the currently resolved TypeScript SDK contract. A fresh install of @browserbasehq/stagehand@4.0.0 resolves @browserbasehq/sdk@2.17.0; its public SessionCreateParams field is api_timeout, and its implementation explicitly converts that to the API body as { timeout: api_timeout, ...body }. Changing this call to timeout fails the template’s strict typecheck with TS2353. I also reran a clean registry install/build and a real Browserbase launch/connect/close using api_timeout, all successfully. The Python SDK intentionally exposes a different language-specific parameter name (timeout).
1 participant
Summary
Stagehand is the SDK for browser agents.
@browserbasehq/stagehand@4.0.0andstagehand==4.0.0for the core SDKsstagehand.agent,Sessions.Execute,AsyncStagehand,new Stagehand,deepLocator, or V3.init()usage remainsbrowserbase.launch()/localBrowser.launch(),Stagehand.create({ browser }),browser.context, V4{ data, metadata }envelopes,locator(), and explicit Stagehand-then-browser cleanupCompanion PR: browserbase/create-browser-app#40
Agent migration: 14 templates
Nine TypeScript templates now use Vercel AI SDK
ToolLoopAgentwith Stagehand code mode's statefulcode_executetool:typescript/agent-with-human-in-looptypescript/browser-agent-demotypescript/business-lookuptypescript/company-address-findertypescript/dynamic-form-fillingtypescript/gemini-3-flashtypescript/gemini-cuatypescript/microsoft-cuatypescript/exa-browserbaseFive Python templates now use Deep Agents with the Stagehand integration's stateful
run,snapshot, andscreenshottools:python/business-lookuppython/cerebras-docs-checkerpython/company-address-finderpython/exa-browserbasepython/gemini-cuaThe Go template's removed autonomous
Sessions.Executestep is now an explicit, verifiable V4Observe→Act→ typedExtractworkflow.Package state
@browserbasehq/stagehand@4.0.0stagehand==4.0.054302fc5f13be5ad8e717d8e1388502de22be2eduntil@browserbasehq/stagehand-codemodeis publishedstagehand/mainsource (packages/integrations/deepagents), with its server dependency on publishedstagehand==4.0.0v0.0.0-20260810174315-a46676658b4funtil the module is taggedThe native
POST /v1/llm/responsesroute is live and was verified through published V4 with a real Browserbase Model Gatewayobserve()call. It is not a blocker or warning for this PR.E2E result
Tested through 2026-08-14 with clean installs, real Browserbase sessions, live sites, real third-party APIs, downloads, extraction, form submissions where safe, and output assertions. After switching the Python Deep Agents integration to
stagehand/main, its clean source install succeeded and all five affected templates were rerun: four passed their full live outcomes, while Cerebras completed the live browser/repository work before reaching the unchanged account-quota blocker. The newly standalone TypeScriptcontextandpickleballtemplates each passed a fresh registry install, strict typecheck, and runtime-import probe; that proof confirmed Pickleball'sapi_timeoutlaunch option against the freshly resolved@browserbasehq/sdk@2.17.0; the SDK maps it to the API body astimeout.Review-readiness assessment: 92% confidence that external access is the only material blocker, 85% confidence that all seven complete on their first credentialed live run, and >95% confidence that any remaining failure is localized third-party friction rather than a systemic V4 migration issue. This is sufficient to begin human review while the seven outcomes remain explicitly labeled as blocked—not passed. Detailed E2E readiness report.
TypeScript Stagehand — 32 pass, 3 blocked
agent-with-human-in-loopaskHuman, consumed the response, submitted the synthetic application, and displayed completion + replay.amazon-global-price-comparisonamazon-product-scrapingbasic-cachingHITtwice; the repeated observation reported 550 tokens saved.basic-recaptchabrowser-agent-demobrowserbase-reducto49025,46222,209586, and201183.business-lookup1376013-12-241.company-address-findercompany-value-prop-generatorcontextSF_REC_PARK_EMAILandSF_REC_PARK_PASSWORD.council-eventsdownload-financial-statementsdynamic-form-fillingYour response has been recorded.exa-browserbaseextend-browserbaseform-fillinggemini-3-flashgemini-cuagift-findergoogle-trendsimage-url-downloadjob-applicationlicense-verification02237476returned the expected licensee, status, expiry, broker, and discipline result.manual-mfa-with-contextsmfa-handlingmicrosoft-cuanurse-verification346, Active.pickleballpolymarket-researchproxiesproxies-weathersec-filing-researchsmart-fetch-scraperwebsite-link-testerPython Stagehand — 28 pass, 4 blocked
amazon-global-price-comparisonamazon-product-scrapingbasic-cachingHITand reported 550 tokens saved.basic-recaptchabrowserbase-reducto49025,46222,209586, and201183.business-lookupcartesia-form-fillingREADY; phone transport stayed disabled.cerebras-docs-checkerbrowserbase/stagehand; final agent verification is blocked because the valid Cerebras key returns HTTP 402 for every available model.company-address-findercompany-value-prop-generatorcontextSF_REC_PARK_EMAILandSF_REC_PARK_PASSWORD.council-eventsdownload-financial-statementsexa-browserbaseextend-browserbaseform-fillinggemini-cuagift-findergoogle-trendsimage-url-downloadjob-applicationlicense-verification02237476returned Dhar with statusLICENSED.manual-mfa-with-contextsmfa-handlingnurse-verification346, Active.pickleballpolymarket-researchproxiesproxies-weathersec-filing-researchsmart-fetch-scraperwebsite-link-testerGo Stagehand — 1 pass
hackernewsNon-Stagehand templates — 9 directories / 10 flows passed
getting-started-with-browserbaseplaywright/basic-recaptchaVerification Success... Hooray!.playwright/quickstart-playwrightplaywright-mfa-handlingpuppeteerseleniumgetting-started-with-browserbaseplaywrightplaywright-mfa-handlingseleniumRepository proof
contextandpickleballboth pass fresh install, strict typecheck, and runtime-import resolutiongit diff --checkpassuv sync; changed files pass compile + Ruffgo mod tidy,gofmt,go vet ./..., and livego run .pass against the exact V4 source versionBefore merge / follow-up
Note
Cursor Bugbot is generating a summary for commit 4eb15f1. Configure here.