chore(cli): import Browse V3 baseline

[shrey150]

Summary

Import packages/cli/** exactly from the published browse@0.9.6 V3 release, without changing its source or runtime behavior.

This is intentionally a provenance checkpoint, not a line-by-line feature review. The imported source is kept runnable by a root, version-scoped pnpm override that resolves its unchanged Stagehand dependency to 3.7.1. #2834 removes that override and contains the actual V4 migration.

Exact-source provenance

• Annotated tag: browse@0.9.6 (548c56407431db27823a212f53475443c7e8358d)
• Release commit: 1d49a95c0c230c346f8d50647e10303d6310fcd2
• Authoritative CLI tree: b4048badce921cf54f199f96033d9a014ef977ec
• This PR's HEAD:packages/cli tree: b4048badce921cf54f199f96033d9a014ef977ec

The tag's ignored README whitespace is retained too; formatting the import would invalidate the tree proof.

Stack

1. chore(cli): import Browse V3 baseline #2833 — exact Browse V3 baseline import
2. refactor(cli): migrate Browse runtime to Stagehand V4 #2834 — Stagehand V4 runtime cutover and CLI-owned cursor
3. fix(cli): restore V3 network capture through a CDP sidecar #2849 — CLI-private CDP sidecar; restores V3 network capture
4. refactor(cli): remove coordinate XPath return flag #2835 — remove --return-xpath; complete supported V3 parity
5. test(evals): exercise the workspace V4 CLI #2838 — eval, packaging, and release wiring
6. fix(cli): persist context names in Browserbase #2839 — managed Context names (fast-follow)
7. refactor(cli): consume shared Functions core #2701 — shared Functions core consumer (fast-follow)

Review boundary

Treat packages/cli/** as trusted release material and verify it by hash. The reviewable integration surface outside the imported tree is limited to workspace CI/build/lint plumbing, the scoped dependency override, lockfile changes, and the Browse changeset allowlist.

This PR is deliberately not a V4 CLI: without the scoped override, the exact V3 source fails against V4 at the expected constructor, context, session, and option API boundaries. Keeping that cutover out of this PR gives #2834 a clean known-good baseline.

E2E Test Matrix

Command / flow	Observed output	Confidence / sufficiency
Compare git rev-parse HEAD:packages/cli with git rev-parse browse@0.9.6^{commit}:packages/cli	Both resolve to b4048badce921cf54f199f96033d9a014ef977ec	Byte-for-byte proof for all 185 imported paths
pnpm --filter browse why @browserbasehq/stagehand	Resolves exactly @browserbasehq/stagehand@3.7.1	Proves this checkpoint runs the V3 dependency, not workspace V4
Browse build and package-owned Prettier/ESLint/typecheck	Passed	Proves the untouched package compiles cleanly in the monorepo
pnpm --filter browse test:cli	25 files / 366 tests passed	Runs the release's imported test suite
Real Chromium: open → snapshot → fill → click → get → stop using the actual branch CLI	Final DOM output Hello Exact V3 import	Proves the exact V3 CLI works from this V4 monorepo checkout
Workspace pnpm check	15/15 tasks passed	Proves the root integration plumbing is composable

No runtime migration behavior should be approved here on trust: all such behavior is isolated in #2834.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d0c0435

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​archiver@​6.0.4
	npm/​@​types/​semver@​7.8.0
	npm/​typescript-eslint@​8.68.0
	npm/​@​types/​node@​20.19.43
	npm/​globals@​17.11.0
	npm/​eslint-plugin-security@​4.0.1
	npm/​@​eslint/​js@​10.0.1
	npm/​prettier@​3.5.3
	npm/​eslint@​10.9.1
	npm/​oclif@​4.24.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/oclif@4.24.0 → npm/@pnpm/network.ca-file@1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[shrey150]

CI follow-up: the imported baseline lockfile had resolved two oclif AWS transitive dependencies less than 24 hours after publication, which violates this repository’s dependency release-age policy. This branch now pins only that pair to the latest policy-eligible release (3.1119.0); the pnpm 11 policy validation passes, and the fix has been propagated through every child in the stack.

[shrey150]

CI follow-up on the current head: the sole failed check, integration/observeElementIdFormat, did not execute its test. setup-chrome failed first while downloading stable Chrome with read ECONNRESET, and the test step was skipped.

I replayed the workflow's exact command locally against Chrome 152 with the same CI browser flags:

CI=true CHROME_PATH=<chrome-152> pnpm run test:integration -- \
  "packages/sdk-ts/tests/integration/observeElementIdFormat.test.ts"

Result: 1 test file passed; 3/3 tests passed in 6.99s. The current GitHub identity cannot request a failed-job rerun (Resource not accessible by integration), so the red check is retained as transparent infrastructure evidence rather than worked around with a no-op commit.