browse 0.9.4 → 0.9.5-alpha-2a6e20b

package/README.md

@@ -277,10 +277,19 @@ export BROWSERBASE_API_KEY=bb_live_...
 
 Local driver commands (`--local`) work without an API key.
 
+`browse` also auto-loads a `.env` file from the current directory on startup, and prints a
+one-time deprecation warning to stderr when it actually pulls a variable from `.env` this way.
+This is deprecated because a CLI used across many unrelated projects can silently pick up a
+stale key from the wrong project's `.env`; a future release will disable auto-loading by
+default so `browse` only reads `process.env`. Set `BROWSE_LOAD_DOTENV=0` (or `false`/`no`) to
+opt out of `.env` auto-loading now, ahead of that change, or `BROWSE_LOAD_DOTENV=1` to keep
+auto-loading with no warning.
+
 | Variable | Description |
 |----------|-------------|
 | `BROWSERBASE_API_KEY` | Enables `--remote` sessions and all `browse cloud` / `functions` commands |
 | `BROWSE_SESSION` | Default session name (alternative to `-s, --session`) |
+| `BROWSE_LOAD_DOTENV` | Controls `.env` auto-loading: unset = load + warn once (default, deprecated), `0`/`false`/`no` = skip loading, anything else = load silently |
 
 ## Links
 

package/bin/run.js

@@ -1,5 +1,31 @@
 #!/usr/bin/env node
-import "dotenv/config";
+import { config as loadDotenvConfig } from "dotenv";
+
+// `BROWSE_LOAD_DOTENV` controls whether `browse` auto-loads a `.env` file
+// from the current working directory. This is deprecated: a future release
+// will flip the default to "off" so `browse` only reads `process.env`,
+// matching how most CLIs used across many unrelated projects behave. Until
+// then we keep loading `.env` by default (unset behaves exactly as before)
+// but warn once when we actually pull a value from it, so users relying on
+// the implicit default get a heads-up before the default changes.
+const dotenvToggle = process.env.BROWSE_LOAD_DOTENV;
+const dotenvOptedOut =
+  dotenvToggle !== undefined &&
+  ["0", "false", "no"].includes(dotenvToggle.toLowerCase());
+
+if (!dotenvOptedOut) {
+  const keysBeforeLoad = new Set(Object.keys(process.env));
+  const { parsed } = loadDotenvConfig();
+  const appliedFromDotenv = Object.keys(parsed ?? {}).filter(
+    (key) => !keysBeforeLoad.has(key),
+  );
+
+  if (appliedFromDotenv.length > 0 && dotenvToggle === undefined) {
+    console.error(
+      `[browse] Loaded ${appliedFromDotenv.join(", ")} from .env. Auto-loading .env is deprecated and will be disabled by default in a future release -- export these variables in your shell instead, or set BROWSE_LOAD_DOTENV=1 to keep this behavior explicitly once that happens. Set BROWSE_LOAD_DOTENV=0 to opt out today. Run \`browse doctor\` to check for conflicts with your shell environment.`,
+    );
+  }
+}
 
 globalThis.oclif = {
   ...globalThis.oclif,

package/dist/commands/skills/show.js

@@ -0,0 +1,20 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { BrowseCommand } from "../../base.js";
+import { fail } from "../../lib/errors.js";
+import { bundledCliSkillPath } from "../../lib/skills/install.js";
+export default class SkillsShow extends BrowseCommand {
+    static description = "Print the bundled browse skill (usage patterns, workflows, gotchas) to stdout. Run before using browse in an agent.";
+    static examples = ["browse skills show"];
+    async run() {
+        const skillMdPath = join(bundledCliSkillPath(), "SKILL.md");
+        let contents;
+        try {
+            contents = await readFile(skillMdPath, "utf8");
+        }
+        catch (error) {
+            fail(`Could not read the bundled browse skill (SKILL.md): ${error.message}`, 1, { resultCode: "skill_show_missing" });
+        }
+        this.log(contents);
+    }
+}

package/dist/help.js

@@ -0,0 +1,19 @@
+import { Help } from "@oclif/core";
+// Custom root-help formatter so `browse --help` (and bare `browse`) lead with
+// a short block pointing agents at the bundled skill, ahead of oclif's
+// auto-generated VERSION/USAGE/DESCRIPTION/COMMANDS sections. Only the root
+// help view is customized -- individual `browse <command> --help` views are
+// unaffected.
+const AGENT_HEADER = `Start here (for AI agents):
+  browse skills show
+
+  The bundled skill ships with the CLI (always version-matched) and covers
+  workflows, session management, and common failure recovery. Prefer it over
+  guessing commands from flag docs alone.
+`;
+export default class BrowseHelp extends Help {
+    async showRootHelp() {
+        this.log(AGENT_HEADER);
+        await super.showRootHelp();
+    }
+}

package/dist/lib/skills/install.js

@@ -167,7 +167,7 @@ function localSkillPath(skillId) {
     const configHome = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
     return join(configHome, "browserbase", "skills", skillId.domain, skillId.task);
 }
-function bundledCliSkillPath() {
+export function bundledCliSkillPath() {
     return join(packageRoot(), "skills", "browse");
 }
 function packageRoot() {

package/oclif.manifest.json

@@ -4536,6 +4536,29 @@
         "list.js"
       ]
     },
+    "skills:show": {
+      "aliases": [],
+      "args": {},
+      "description": "Print the bundled browse skill (usage patterns, workflows, gotchas) to stdout. Run before using browse in an agent.",
+      "examples": [
+        "browse skills show"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:show",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "show.js"
+      ]
+    },
     "tab:close": {
       "aliases": [],
       "args": {
@@ -6398,5 +6421,5 @@
       ]
     }
   },
-  "version": "0.9.4"
+  "version": "0.9.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browse",
-  "version": "0.9.4",
+  "version": "0.9.5-alpha-2a6e20b",
   "description": "Unified Browserbase CLI for browser automation and cloud APIs.",
   "type": "module",
   "private": false,
@@ -24,6 +24,7 @@
     "bin": "browse",
     "dirname": "browse",
     "commands": "./dist/commands",
+    "helpClass": "./dist/help.js",
     "hooks": {
       "init": "./dist/hooks/init.js",
       "prerun": "./dist/hooks/prerun.js",
@@ -100,7 +101,7 @@
     "tsx": "^4.20.6",
     "ws": "^8.18.3",
     "zod": "^4.2.1",
-    "@browserbasehq/stagehand": "3.6.0"
+    "@browserbasehq/stagehand": "3.7.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/skills/browse/SKILL.md

@@ -65,12 +65,16 @@ browse open https://example.com --cdp ws://127.0.0.1:9222/devtools/browser/<id>
 
 Use local mode for development, localhost, trusted sites, and fast iteration. Use `--auto-connect` only when the user explicitly wants to attach to an already-running debuggable Chrome session with existing cookies or login state; use `--local` when no debuggable Chrome is available. Use remote mode when Browserbase credentials are available and the site needs hosted browser infrastructure, Verified browser mode, CAPTCHA solving, proxies, or session persistence.
 
+`--local` requires Chrome or Chromium already installed on the machine. In containers, CI, and sandboxes with no browser installed, use `--remote` instead of `--local`. If `--local` fails with "No Chrome or Chromium found" and `BROWSERBASE_API_KEY` is set, switch to `--remote` — do not retry `--local`.
+
 For a Verified and/or proxied remote session, add `--verified` and/or `--proxies` to `--remote` — a single command that keeps the Browserbase session identity, so `browse status` and `browse doctor` report the session ID and live-view URL. `--verified` requires a Browserbase Scale plan. These flags only apply to `--remote` and are sticky for the session's lifetime, like `--headed`. Reach for `browse cloud sessions create` + `--cdp` only when you need session options `open` doesn't expose (region, keep-alive, contexts).
 
 Choose headed/headless and local/remote mode when starting a session. A running session keeps its mode: passing a conflicting flag such as `--headed` to an already-running headless session fails until you run `browse stop --session <name>` or target a different session.
 
 Use named sessions for any non-trivial work, especially when multiple agents or parallel tasks may run at once. Every browser command accepts `--session <name>` (or `-s <name>`); the `BROWSE_SESSION` env var sets the default, and commands without either share the `default` session.
 
+If `BROWSE_SESSION` is already set in the environment, every command already targets that session — do not pass `--session` or invent a new name. An explicit `--session <name>` always overrides `BROWSE_SESSION` for that command, so only pass it to deliberately target a different session.
+
 ```bash
 browse open https://example.com --session research --local
 browse snapshot --session research