feat: add Stagehand connector

[andrei-hasna]

Summary

• Add @hasna/connect-stagehand REST connector for the Stagehand browser agent platform (https://api.stagehand.dev/v1)
• Bearer auth client with runs, events, search, and raw request APIs plus CLI/profile scaffolding
• Register stagehand in AI & ML between stammerai and studiobyai21labs

Test plan

• cd connectors/stagehand && bun install && bun run typecheck && bun run build && bun test (7 pass)
• bun run typecheck (repo root)
• bun run build && bun test (1193 pass, 1 pre-existing unrelated CLI events test fail)
• Grep: no beepmedia/hasnaxyz secrets; no browser-use/puppeteer/playwright deps

[andrei-hasna]

Automated OpenLoops review for task f478b1b1-3142-4c3c-863a-31465fa0f2f7: not merging this PR as-is.

Validation on the merged tree passed mechanically after building first:

• TMPDIR=/tmp bun run typecheck passed
• TMPDIR=/tmp bun run build passed
• HOME=/tmp/open-connectors-test-home TMPDIR=/tmp bun test passed: 2041 pass, 0 fail
• connectors/stagehand: bun run typecheck, focused bun test connectors/stagehand/src/api/client.test.ts, and bun run build passed

Merge blocker: the implemented Stagehand API contract appears incompatible with the current official Stagehand v3 API. The PR implements https://api.stagehand.dev/v1 with /runs, /events, /search, and Authorization: Bearer <STAGEHAND_API_KEY>. Current official docs/OpenAPI show https://api.stagehand.browserbase.com, session endpoints such as /v1/sessions/start, /v1/sessions/{id}/navigate, /v1/sessions/{id}/act, /v1/sessions/{id}/observe, /v1/sessions/{id}/extract, /v1/sessions/{id}/agentExecute, /v1/sessions/{id}/replay, /v1/sessions/{id}/end, and auth headers x-bb-api-key plus x-model-api-key.

Sources checked:

• https://docs.stagehand.dev/v3/api-reference/python/start-a-new-browser-session
• https://docs.stagehand.dev/v3/api-reference/python/navigate-to-a-url
• https://app.stainless.com/api/spec/documented/stagehand/openapi.documented.yml

Additional checks: the package is REST-only and did not add browser-use, Playwright, Puppeteer, Selenium, or @browserbasehq/stagehand dependencies. Static scans found no internal-domain references; the redaction scanner flagged only placeholder/test-style auth strings in the diff, not a real credential.

Required fix before merge: remodel the connector around the documented Stagehand session API and Browserbase/model credentials, then update tests so they assert the documented endpoint/header contract rather than the current /runs bearer-token contract.

[andrei-hasna]

OpenLoops merge review for task 9bc2ceb9-73cc-44f1-9428-70f2998380a7: not merging PR #291 as-is.\n\nCurrent GitHub state: PR is open, not draft, base main, mergeable=CLEAN/MERGEABLE, CI build passed, no reviews recorded.\n\nLocal validation on the PR head passed mechanically after installing dependencies with Bun temp/cache forced under /tmp:\n- bun run typecheck passed\n- bun run build passed\n- bun test connectors/stagehand/src/api/client.test.ts passed: 7 pass, 0 fail\n- connectors/stagehand: bun run typecheck and bun run build passed\n- git diff --check origin/main...origin/pr-291-stagehand passed\n- Static scan found no real secret evidence; only placeholder/test-style key strings.\n\nMerge blocker: the connector still appears to implement the wrong Stagehand API contract. It hardcodes https://api.stagehand.dev/v1, Authorization: Bearer ..., and public methods/CLI around /runs, /events, and /search. Current Stagehand v3 docs show the session API on https://api.stagehand.browserbase.com, with auth via Browserbase headers such as x-bb-api-key, and endpoints including /v1/sessions/start, /{id}/navigate, /{id}/act, /{id}/observe, /{id}/extract, /{id}/agentExecute, /{id}/replay, and /{id}/end.\n\nSources checked: https://docs.stagehand.dev/v3/api-reference/python/start-a-new-browser-session and https://docs.stagehand.dev/v3/api-reference/python/navigate-to-a-url.\n\nIndependent adversarial review reached the same conclusion: validation does not justify merge because the passing tests assert the incorrect /runs bearer-token contract rather than the documented Stagehand API. It also flagged that this is adjacent to the repo browser-automation blacklist policy, so owner confirmation is needed even though the PR adds no browser-use/Playwright/Puppeteer/Selenium dependency.\n\nFollow-up Todos task created: 95bc8f28 (Fix Stagehand connector API contract before merging PR #291).

[andrei-hasna]

OpenLoops worker update for todos task 1c329bd2-964a-4ace-ba39-88d120113cd5.

Updated the PR head to d6e7af0 with a REST-only Stagehand v3 session API connector:

• Base URL: https://api.stagehand.browserbase.com
• Session endpoints: /v1/sessions/start, /v1/sessions/{id}/navigate, /act, /observe, /extract, /agentExecute, /replay, /end
• Auth headers: x-bb-api-key, optional x-bb-project-id, x-model-api-key
• Removed the legacy /runs-style bearer-token contract from connector code/tests/docs.

Validation passed locally:

• connectors/stagehand: bun run typecheck
• connectors/stagehand: bun test (12 pass)
• connectors/stagehand: bun run build, including dist/index.d.ts and bin/index.js
• root: bun run typecheck
• root: bun run build
• root: bun test (2329 pass, 0 fail)
• git diff --cached --check before commit
• bun run secrets:scan:npmrc
• staged credential-pattern scan
• diff scans for stale Stagehand contract strings, internal references, and forbidden browser automation dependencies

Independent adversarial review was performed before push; findings were reconciled before this commit. PR is left unmerged for the selected non-author reviewer kriptoburak and verifier step.

[andrei-hasna]

Remote CI update for OpenLoops task 1c329bd2-964a-4ace-ba39-88d120113cd5: GitHub Actions build passed on head d6e7af0.

Job: https://github.com/hasna/connectors/actions/runs/28854970731/job/85579156426
Result: build pass in 1m41s, including install, dashboard install, typecheck, build, and test.

Formal review request for kriptoburak could not be added because GitHub returned HTTP 422: reviewer is not a collaborator on hasna/connectors. PR remains open and unmerged for verifier/independent review.