Remove tsup, generate unified re-used ESM and CJS builds with sourcemaps and types, switch CI to new Evals CLI

[pirate]

why

what changed

test plan

---

Summary by cubic

Removes tsup and rebuilds the SDK as ESM-first with a CJS entry, unified sourcemaps, and types. CI runs Vitest/Playwright and the new Evals CLI solely against the built ESM dist with verified runner Chromium, proper CHROME_PATH propagation, weighted Browserbase region routing, normalized V8 coverage, and fixed artifacts/test discovery.

• New Features

  • Build/Exports: ESM in dist/esm and CJS in dist/cjs via export map; types from ESM; SEA binaries built from dist with sourcemaps; new build/test/coverage scripts and a Node loader resolving to dist/esm; Prettier ignores server OpenAPI YAML/YML.
  • CI: Consolidated workflows and composite actions (setup-node-pnpm-turbo, verify-chromium-launch, select-browserbase-region, upload-ctrf-report, upload-v8-coverage); uses runner Chromium; unique CTRF artifacts with merged V8 coverage; region weighting for Browserbase; fixed artifact paths and dist/esm test discovery; e2e tests run only on dist/esm; fixed Turbo and CHROME_PATH passing.
  • Tests & API: Vitest/Playwright run on dist/esm; added env reporter and closeV3 helper; force disableAPI in e2e; tighter multi-click dispatch and higher timeouts; auto-skip BB console-event test; split SPIF/OOPIF shadow-iframe tests; moved AISdk/CustomOpenAI clients to lib/v3/external_clients and exported; replay metrics now include parameters/result/timestamps/cost with parsing fixes.

• Migration

  • Set STAGEHAND_BROWSER_TARGET=local|browserbase and CHROME_PATH; tune LLM_MAX_MS, BROWSERBASE_SESSION_CREATE_MAX_MS, and BROWSERBASE_CDP_CONNECT_MAX_MS; optionally set BROWSERBASE_REGION_DISTRIBUTION for e2e.
  • dotenv support is removed; set env vars explicitly in dev and CI.
  • Import from @browserbasehq/stagehand via the export map; don’t reference dist paths or prior tsup outputs.

^{Written for commit 1a23a13. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

6 issues found across 67 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/core/scripts/normalize-v8-coverage.ts">

<violation number="1" location="packages/core/scripts/normalize-v8-coverage.ts:267">
P2: SourceMapConsumer cleanup not in a `finally` block. If an error occurs during processing, the `consumer.destroy()` calls on lines 269-271 will be skipped, causing memory leaks. Wrap the processing logic in try/finally to ensure cleanup.</violation>

<violation number="2" location="packages/core/scripts/normalize-v8-coverage.ts:296">
P2: Unhandled promise rejection in main entry point. The `void main()` call discards the promise without handling potential errors from `normalizeV8Coverage`. Add a `.catch()` handler to log errors and exit with a non-zero code.</violation>
</file>

<file name="packages/core/package.json">

<violation number="1" location="packages/core/package.json:29">
P1: Scripts `e2e:local` and `e2e:bb` reference non-existent `test:e2e:local` and `test:e2e:bb` scripts in this package. These either need to be defined locally with the appropriate `STAGEHAND_BROWSER_TARGET` env var, or the alias scripts should set the env var directly.</violation>
</file>

<file name="packages/server/scripts/test-server.ts">

<violation number="1" location="packages/server/scripts/test-server.ts:89">
P2: The `?? process.env.STAGEHAND_API_URL` fallback is dead code since `baseUrl` is always defined (never nullish). If the intent is to always overwrite, remove the fallback. If the intent is to preserve an existing `STAGEHAND_API_URL`, this logic is incorrect.</violation>
</file>

<file name="packages/core/scripts/coverage.ts">

<violation number="1" location="packages/core/scripts/coverage.ts:93">
P2: Missing error check for spawn failure. If `spawnSync` fails (e.g., `pnpm` or `c8` not found), `result.error` will be set but ignored, and the script exits silently with code 1. Add error handling before processing stdout/stderr to provide diagnostic output.</violation>
</file>

<file name="packages/evals/scripts/test-evals.ts">

<violation number="1" location="packages/evals/scripts/test-evals.ts:27">
P2: Missing error handling around `JSON.parse`. If `eval-summary.json` exists but contains malformed JSON, the script will crash without generating the CTRF report, potentially breaking CI silently. Consider wrapping the JSON parsing in a try/catch and falling back to the missing report case on parse errors.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}