Conversation
Add the sensitiveData parameter to RunTaskRequest in both OpenAPI specs (cloud + open-source), generated types (Python models + Node types), and hand-written SDK clients (Python sessions.create, client.run, client.stream). The field accepts key-value string pairs for secrets (passwords, API keys) that the agent enters via secure <secret>key</secret> placeholders. Values are never exposed to the LLM. Includes a warning that sensitive data may be visible in screenshots if rendered in unmasked form fields. Also adds missing useOwnKey and autoHeal fields to cloud OpenAPI spec.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 77fb17ebfc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| proxy_country_code=proxy_country_code, | ||
| output_schema=schema_dict, | ||
| workspace_id=workspace_id, | ||
| sensitive_data=sensitive_data, |
There was a problem hiding this comment.
AsyncBrowserUse.run() now forwards sensitive_data into self.sessions.create(...), but the method signature never defines sensitive_data, so this name is unresolved in the closure and raises NameError when the async run is executed. This breaks AsyncBrowserUse.run() for normal usage (even when callers do not pass sensitive data), and also makes the new field unusable from the async client.
Useful? React with 👍 / 👎.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 6 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="browser-use-python/src/browser_use_sdk/v3/client.py">
<violation number="1" location="browser-use-python/src/browser_use_sdk/v3/client.py:161">
P0: This added call passes `sensitive_data` from an undefined variable, which will raise `NameError` at runtime and break `AsyncBrowserUse.run()`.</violation>
</file>
<file name="docs/cloud/openapi/v3.json">
<violation number="1" location="docs/cloud/openapi/v3.json:3055">
P3: The new `autoHeal` description references `cache_script`, but the request field is `cacheScript`; use the actual camelCase field name to avoid misleading API docs.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.
| "autoHeal": { | ||
| "type": "boolean", | ||
| "title": "Autoheal", | ||
| "description": "When cache_script is active, controls whether a lightweight LLM validates the cached script output. If the output looks incorrect (empty, error, wrong structure), the system automatically re-triggers the full agent to generate a new version of the script. Set to false to disable validation and always return the raw script output.", |
There was a problem hiding this comment.
P3: The new autoHeal description references cache_script, but the request field is cacheScript; use the actual camelCase field name to avoid misleading API docs.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At docs/cloud/openapi/v3.json, line 3055:
<comment>The new `autoHeal` description references `cache_script`, but the request field is `cacheScript`; use the actual camelCase field name to avoid misleading API docs.</comment>
<file context>
@@ -3027,6 +3042,18 @@
+ "autoHeal": {
+ "type": "boolean",
+ "title": "Autoheal",
+ "description": "When cache_script is active, controls whether a lightweight LLM validates the cached script output. If the output looks incorrect (empty, error, wrong structure), the system automatically re-triggers the full agent to generate a new version of the script. Set to false to disable validation and always return the raw script output.",
+ "default": true
}
</file context>
| "description": "When cache_script is active, controls whether a lightweight LLM validates the cached script output. If the output looks incorrect (empty, error, wrong structure), the system automatically re-triggers the full agent to generate a new version of the script. Set to false to disable validation and always return the raw script output.", | |
| "description": "When cacheScript is active, controls whether a lightweight LLM validates the cached script output. If the output looks incorrect (empty, error, wrong structure), the system automatically re-triggers the full agent to generate a new version of the script. Set to false to disable validation and always return the raw script output.", |
…mp to 3.4.3 The async client referenced sensitive_data without declaring it in the method signature, causing a Pyright error and runtime NameError for async users. Also bumps both SDKs from 3.4.2 → 3.4.3 for publish. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
1 issue found across 4 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="browser-use-python/src/browser_use_sdk/v3/client.py">
<violation number="1" location="browser-use-python/src/browser_use_sdk/v3/client.py:339">
P2: `sensitive_data` was added to the concrete `run()` signature but not to all `@overload` signatures, causing incorrect type-checker errors for valid calls.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.
| profile_id: str | None = None, | ||
| proxy_country_code: str | None = _UNSET, # type: ignore[assignment] | ||
| workspace_id: str | None = None, | ||
| sensitive_data: dict[str, str] | None = None, |
There was a problem hiding this comment.
P2: sensitive_data was added to the concrete run() signature but not to all @overload signatures, causing incorrect type-checker errors for valid calls.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At browser-use-python/src/browser_use_sdk/v3/client.py, line 339:
<comment>`sensitive_data` was added to the concrete `run()` signature but not to all `@overload` signatures, causing incorrect type-checker errors for valid calls.</comment>
<file context>
@@ -336,6 +336,7 @@ def run(
profile_id: str | None = None,
proxy_country_code: str | None = _UNSET, # type: ignore[assignment]
workspace_id: str | None = None,
+ sensitive_data: dict[str, str] | None = None,
enable_recording: bool | None = None,
cache_script: bool | None = None,
</file context>
1 participant
Summary
sensitiveDataparameter toRunTaskRequestin both OpenAPI v3 specs (cloud + open-source)models.pyand Nodetypes.tssensitive_dataparam to Python SDK'ssessions.create(),client.run(), andclient.stream()RunTaskRequesttypeuseOwnKeyandautoHealfields to cloud OpenAPI specUsage
Test plan
sensitiveDatain request bodysensitiveDataonRunTaskRequesttask checkto type-check both SDKsCompanion to browser-use/cloud#3623
🤖 Generated with Claude Code
Summary by cubic
Add
sensitiveDatato the v3 API and SDKs so tasks can pass secrets via secure<secret>key</secret>placeholders. Also addsuseOwnKeyandautoHealto the cloud spec and fixes the async Python client; SDKs bumped to 3.4.3.New Features
sensitiveDatatoRunTaskRequestindocs/openapi/v3.jsonanddocs/cloud/openapi/v3.json; addeduseOwnKeyandautoHealto the cloud spec.v3/types.tsincludessensitiveData; Python generatedv3/models.pyand clients acceptsensitive_datainsessions.create(),client.run(), andclient.stream(). Values are not sent to the LLM, but may appear in screenshots if unmasked.Bug Fixes
run()now declares thesensitive_dataparam to fix Pyright and runtime errors.Written for commit 1e58d20. Summary will update on new commits.