feat: add local Stagehand code-mode tool - #91
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
|
Update: the Mastra integration and this transitive dependency now live in the stacked Mastra PR. This foundation PR no longer adds Mastra or |
a9dc7de to
c314f9d
Compare
shrey150
changed the title
| 'Execute an async JavaScript function body against one long-lived Stagehand V4 browser on Browserbase.', | ||
| 'The local executor lazily creates the browser on the first call and reuses it for later calls.', | ||
| 'Code runs directly in the local MCP process. The owning agent framework should terminate and restart that process if it stops responding.', | ||
| 'This is trusted local code with filesystem, network, and in-process SDK access; it is not a security sandbox.', |
There was a problem hiding this comment.
in something like eve this would be a sandbox
| @@ -0,0 +1,88 @@ | |||
| # Stagehand V4 code-mode syntax skill | |||
|
|
|||
| You have one `code_execute` tool. Its `code` argument is the body of an async JavaScript function, | |||
There was a problem hiding this comment.
let's embed a line saying that the most up-to-date knowledge can be found by grepping through the embedded docs package in @browserbasehq/stagehand
There was a problem hiding this comment.
we should probably also add a REFERENCE.md with exhaustive documentation, or just point the agent to the docs for this
| }; | ||
| } | ||
|
|
||
| function nonEmpty(value: string | undefined): string | undefined { |
There was a problem hiding this comment.
is there not a utility function for this from lodash or a similar package?
| if (this.stagehand) return this.stagehand; | ||
| if (!this.options.browserbaseApiKey) { | ||
| throw new Error( | ||
| 'BROWSERBASE_API_KEY is required before the first code_execute call.' |
There was a problem hiding this comment.
is this strictly true? Stagehand can run in local mode
| } | ||
|
|
||
| const packageName = '@browserbasehq/stagehand'; | ||
| const imported = (await import(packageName)) as { |
There was a problem hiding this comment.
do we need a dynamic import? why can't we just import it statically at the top? is this because we are dynamically eval'ing JavaScript?
|
|
||
| const next = new imported.Stagehand({ | ||
| apiKey: this.options.browserbaseApiKey, | ||
| browser: { type: 'browserbase' }, |
There was a problem hiding this comment.
don't think it always needs to be Browserbase here - can also be local browser
|
Superseded by the staged implementation in browserbase/stagehand#2597, #2619, and #2620. Keeping the canonical MCP host, code tool, guidance, and tests together lets framework examples consume the exact workspace build without waiting for package publication. |
2 participants
Summary
code_executecontractStack
This is the framework-neutral foundation for four independently reviewable bindings:
Architecture
One executor lazily creates a Browserbase-backed Stagehand instance, serializes calls, and reuses the
same browser until the stdio process closes. Callers do not manage an opaque session identifier.
Generated JavaScript runs directly in the local MCP process with
page,context,stagehand,z,and a captured
consolein scope. This is trusted local code, not a security sandbox. If a call stopsresponding, the owning agent framework terminates and relaunches the MCP process; that restart also
starts a fresh browser. The package does not add a nested worker, private IPC protocol, or per-call
timeout layer.
Stagehand is resolved from the consuming application so framework integrations use the same V4 SDK
installation as the executor. The package documents both local stdio MCP and native-tool integration,
including lifecycle ownership, configuration, result types, model guidance, limits, and the trusted-code
security boundary.
E2E Test Matrix
<scratch MCP client>→ builtdist/stdio-server.js→<local Stagehand V4 build>→ real Browserbase browsercode_execute; input required onlycode; syntax guide was embedded. Nine sequential calls completed: a two-tab fixture retained both pages and their text, the Wichita fixture revealed closed bids and returnedtotal_results: 430, and a live arXiv search returned two papers before opening one and extracting its title, abstract, and subjects.act,observe,extract, and Zod are in scope but does not make a provider-dependent model request.pnpm --filter @browserbasehq/stagehand-codemode run typecheckandpnpm --filter @browserbasehq/stagehand-codemode run buildtsdownemitted the internal stdio server entrypoint, library, declarations, and source maps from two entry points.