browse 0.10.0 → 0.11.1

package/dist/lib/secrets/seal.js

@@ -0,0 +1,30 @@
+import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
+import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
+import { fail } from "../errors.js";
+export async function sealSecret(publicKey, value) {
+    if (typeof publicKey !== "string") {
+        fail("The secrets API returned an invalid X25519 public key.");
+    }
+    const rawKey = Buffer.from(publicKey, "base64");
+    if (rawKey.length !== 32 || rawKey.toString("base64") !== publicKey) {
+        fail("The secrets API returned an invalid X25519 public key.");
+    }
+    const suite = new CipherSuite({
+        kem: new DhkemX25519HkdfSha256(),
+        kdf: new HkdfSha256(),
+        aead: new Aes256Gcm(),
+    });
+    try {
+        const recipientPublicKey = await suite.kem.deserializePublicKey(new Uint8Array(rawKey).buffer);
+        const sender = await suite.createSenderContext({ recipientPublicKey });
+        const ciphertext = await sender.seal(new Uint8Array(value).buffer);
+        // Go's crypto/hpke.Open expects the encapsulated key followed by ciphertext.
+        return Buffer.concat([
+            Buffer.from(sender.enc),
+            Buffer.from(ciphertext),
+        ]).toString("base64");
+    }
+    catch {
+        fail("Failed to encrypt the secret with the project's public key.");
+    }
+}

package/dist/lib/templates/api.js

@@ -107,6 +107,7 @@ function parseTemplate(payload, context) {
         description: optionalString(payload.description, context, "description"),
         descriptionTitle: optionalString(payload.descriptionTitle, context, "descriptionTitle"),
         source: optionalString(payload.source, context, "source"),
+        sourcePath: optionalString(payload.sourcePath, context, "sourcePath"),
         category: optionalStringArray(payload.category, context, "category"),
         tags: optionalStringArray(payload.tags, context, "tags"),
         commands: optionalStringArray(payload.commands, context, "commands"),

package/dist/lib/templates/scaffold.js

@@ -28,18 +28,15 @@ export async function cloneTemplate(options) {
     const parentDir = dirname(dest);
     const projectName = basename(dest);
     const scaffolder = getScaffolder(language);
+    // create-browser-app identifies a template by its final source directory.
+    const scaffolderTemplate = basename(options.template.sourcePath || options.template.slug);
     await mkdir(parentDir, { recursive: true });
     const existingEntries = await getDirectoryEntryNames(parentDir);
     if (!options.quiet) {
         console.log(`Scaffolding ${language}/${options.template.slug} into ${dest}...`);
     }
     try {
-        runCommand(scaffolder.command, [
-            ...scaffolder.argsPrefix,
-            projectName,
-            "--template",
-            options.template.slug,
-        ], parentDir);
+        runCommand(scaffolder.command, [...scaffolder.argsPrefix, projectName, "--template", scaffolderTemplate], parentDir);
         const createdDir = await findCreatedProjectDir(parentDir, existingEntries, projectName);
         if (!createdDir) {
             throw new Error(`Scaffolder did not create a project directory in ${parentDir}.`);
@@ -151,22 +148,23 @@ async function findCreatedProjectDir(parentDir, existingEntries, requestedName)
     }
     return null;
 }
-async function buildNextSteps(dest, displayPath, language) {
+export async function buildNextSteps(dest, displayPath, language) {
     const nextSteps = [`cd ${displayPath}`];
     if (language === "typescript") {
-        if (existsSync(join(dest, "package.json"))) {
-            nextSteps.push("npm install");
+        const packageJson = await readPackageJson(dest);
+        const packageManager = resolvePackageManager(packageJson?.packageManager);
+        if (packageJson) {
+            nextSteps.push(`${packageManager} install`);
         }
         if (existsSync(join(dest, ".env.example"))) {
             nextSteps.push("cp .env.example .env");
         }
-        const packageJson = await readPackageJson(dest);
         if (packageJson?.scripts?.dev) {
-            nextSteps.push("npm run dev");
+            nextSteps.push(runPackageScript(packageManager, "dev"));
             return nextSteps;
         }
         if (packageJson?.scripts?.start) {
-            nextSteps.push("npm start");
+            nextSteps.push(runPackageScript(packageManager, "start"));
             return nextSteps;
         }
         if (existsSync(join(dest, "index.ts"))) {
@@ -174,17 +172,19 @@ async function buildNextSteps(dest, displayPath, language) {
         }
         return nextSteps;
     }
-    if (existsSync(join(dest, "pyproject.toml"))) {
+    const hasPyproject = existsSync(join(dest, "pyproject.toml"));
+    const hasRequirements = existsSync(join(dest, "requirements.txt"));
+    if (hasPyproject) {
         nextSteps.push("uv sync");
     }
-    else if (existsSync(join(dest, "requirements.txt"))) {
-        nextSteps.push("pip install -r requirements.txt");
+    else if (hasRequirements) {
+        nextSteps.push("uv venv && uv pip install -r requirements.txt");
     }
     if (existsSync(join(dest, ".env.example"))) {
         nextSteps.push("cp .env.example .env");
     }
     if (existsSync(join(dest, "main.py"))) {
-        nextSteps.push("python main.py");
+        nextSteps.push("uv run python main.py");
     }
     return nextSteps;
 }
@@ -201,3 +201,16 @@ async function readPackageJson(dest) {
         return null;
     }
 }
+function resolvePackageManager(packageManager) {
+    const name = packageManager?.split("@")[0];
+    if (name === "bun" || name === "pnpm" || name === "yarn") {
+        return name;
+    }
+    return "npm";
+}
+function runPackageScript(packageManager, script) {
+    if (packageManager === "npm" || packageManager === "bun") {
+        return `${packageManager} run ${script}`;
+    }
+    return `${packageManager} ${script}`;
+}

package/oclif.manifest.json

@@ -5803,6 +5803,313 @@
         "usage.js"
       ]
     },
+    "cloud:secrets:create": {
+      "aliases": [],
+      "args": {
+        "key": {
+          "description": "Name exposed in the function context.secrets object.",
+          "name": "key",
+          "required": true
+        }
+      },
+      "description": "Create a project secret. Encrypts the value locally with the project public key.",
+      "examples": [
+        "browse cloud secrets create SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --env MY_SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --stdin < ./secret.txt"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        },
+        "env": {
+          "description": "Read the secret value from the named environment variable.",
+          "exclusive": [
+            "stdin"
+          ],
+          "name": "env",
+          "hasDynamicHelp": false,
+          "helpValue": "VARIABLE_NAME",
+          "multiple": false,
+          "type": "option"
+        },
+        "stdin": {
+          "description": "Read the exact secret value from stdin, preserving whitespace.",
+          "exclusive": [
+            "env"
+          ],
+          "name": "stdin",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:secrets:create",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "secrets",
+        "create.js"
+      ]
+    },
+    "cloud:secrets:delete": {
+      "aliases": [],
+      "args": {
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Delete a project secret.",
+      "examples": [
+        "browse cloud secrets delete <secretId>",
+        "browse cloud secrets delete d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:secrets:delete",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "secrets",
+        "delete.js"
+      ]
+    },
+    "cloud:secrets:get": {
+      "aliases": [],
+      "args": {
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Get project secret metadata. Does not return the secret value.",
+      "examples": [
+        "browse cloud secrets get <secretId>",
+        "browse cloud secrets get d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:secrets:get",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "secrets",
+        "get.js"
+      ]
+    },
+    "cloud:secrets:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List project secret metadata with cursor pagination.",
+      "examples": [
+        "browse cloud secrets list",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse cloud secrets list --limit 10"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Maximum results per page (API default: 20).",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "cursor": {
+          "description": "nextCursor from the previous page. Keep the same filters.",
+          "name": "cursor",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "start-at": {
+          "description": "Include secrets created on or after this RFC 3339 timestamp.",
+          "name": "start-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "end-at": {
+          "description": "Include secrets created on or before this RFC 3339 timestamp.",
+          "name": "end-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:secrets:list",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "secrets",
+        "list.js"
+      ]
+    },
+    "cloud:secrets:update": {
+      "aliases": [],
+      "args": {
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Replace a secret value, encrypting it locally with the current project public key.",
+      "examples": [
+        "browse cloud secrets update <secretId>",
+        "browse cloud secrets update d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+        "browse cloud secrets update <secretId> --env MY_SERVICE_TOKEN",
+        "browse cloud secrets update <secretId> --stdin < ./secret.txt"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        },
+        "env": {
+          "description": "Read the secret value from the named environment variable.",
+          "exclusive": [
+            "stdin"
+          ],
+          "name": "env",
+          "hasDynamicHelp": false,
+          "helpValue": "VARIABLE_NAME",
+          "multiple": false,
+          "type": "option"
+        },
+        "stdin": {
+          "description": "Read the exact secret value from stdin, preserving whitespace.",
+          "exclusive": [
+            "env"
+          ],
+          "name": "stdin",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:secrets:update",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "secrets",
+        "update.js"
+      ]
+    },
     "cloud:sessions:create": {
       "aliases": [],
       "args": {},
@@ -6300,6 +6607,191 @@
         "update.js"
       ]
     },
+    "functions:secrets:attach": {
+      "aliases": [],
+      "args": {
+        "functionId": {
+          "description": "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+          "name": "functionId",
+          "required": true
+        },
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Attach an existing project secret to a function.",
+      "examples": [
+        "browse functions secrets attach <functionId> <secretId>",
+        "browse functions secrets attach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "functions:secrets:attach",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "functions",
+        "secrets",
+        "attach.js"
+      ]
+    },
+    "functions:secrets:detach": {
+      "aliases": [],
+      "args": {
+        "functionId": {
+          "description": "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+          "name": "functionId",
+          "required": true
+        },
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Detach a secret from a function without deleting the secret.",
+      "examples": [
+        "browse functions secrets detach <functionId> <secretId>",
+        "browse functions secrets detach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "functions:secrets:detach",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "functions",
+        "secrets",
+        "detach.js"
+      ]
+    },
+    "functions:secrets:list": {
+      "aliases": [],
+      "args": {
+        "functionId": {
+          "description": "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+          "name": "functionId",
+          "required": true
+        }
+      },
+      "description": "List metadata for secrets attached to a function with cursor pagination.",
+      "examples": [
+        "browse functions secrets list <functionId>",
+        "browse functions secrets list 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse functions secrets list <functionId> --limit 10"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Maximum results per page (API default: 20).",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "cursor": {
+          "description": "nextCursor from the previous page. Keep the same filters.",
+          "name": "cursor",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "start-at": {
+          "description": "Include secrets created on or after this RFC 3339 timestamp.",
+          "name": "start-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "end-at": {
+          "description": "Include secrets created on or before this RFC 3339 timestamp.",
+          "name": "end-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "functions:secrets:list",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "functions",
+        "secrets",
+        "list.js"
+      ]
+    },
     "cloud:sessions:downloads:get": {
       "aliases": [],
       "args": {
@@ -6411,5 +6903,5 @@
       ]
     }
   },
-  "version": "0.10.0"
+  "version": "0.11.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browse",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Unified Browserbase CLI for browser automation and cloud APIs.",
   "type": "module",
   "private": false,
@@ -36,6 +36,9 @@
       "cloud": {
         "description": "Manage Browserbase cloud resources and APIs."
       },
+      "cloud:secrets": {
+        "description": "Create, list, retrieve, update, and delete project secrets."
+      },
       "cloud:projects": {
         "description": "Manage Browserbase projects."
       },
@@ -54,6 +57,9 @@
       "cloud:sessions:uploads": {
         "description": "Upload files to Browserbase sessions."
       },
+      "functions:secrets": {
+        "description": "List, attach, and detach project secrets for functions."
+      },
       "functions": {
         "description": "Develop, publish, and invoke Browserbase Functions."
       },
@@ -88,6 +94,9 @@
   },
   "dependencies": {
     "@browserbasehq/sdk": "^2.14.0",
+    "@hpke/core": "^1.9.0",
+    "@hpke/dhkem-x25519": "^1.8.0",
+    "@inquirer/password": "^4.0.23",
     "@oclif/core": "^4.11.0",
     "@vercel/detect-agent": "^1.2.3",
     "archiver": "^7.0.1",