refactor(cli): consume shared Functions core

[shrey150]

BLUF

Replace Browse's parallel Functions implementation with thin Oclif adapters over the canonical @browserbasehq/sdk-functions/core library. This removes roughly 1,300 lines of duplicate API/archive/runtime code while preserving Browse's JSON output, telemetry, flags, and signal handling.

Dependency stack

• Depends on tactical parity PR fix(cli): align Functions with SDK #2700.
• Depends on the SDK core PR: feat: expose reusable Functions core sdk-functions-node#40.
• This draft pins the exact tested SDK commit 4d7db8bdc5917fed0af17e78fe4cc8ed33e64468.
• The Git dependency requires the SDK prepare build and a temporary pnpm allowBuilds entry.

Do not publish Browse from this commit pin. After @browserbasehq/sdk-functions@1.1.0 is released, replace the catalog entry with ^1.1.0, remove the temporary allowBuilds entry/TODO, regenerate the lockfile, and rerun the full matrix before merge.

What stays host-specific

Browse retains only the CLI concerns that should differ by host: Oclif flags, structured JSON output, telemetry classification, process exit codes, stderr logging, and SIGINT/SIGTERM ownership. The shared SDK core owns scaffolding, archive rules, Functions HTTP requests, project inference/override, polling, and local runtime behavior.

An explicit contract test verifies that importing @browserbasehq/sdk-functions/core does not execute the package's bundled Commander CLI.

E2E test matrix

Command / flow	Observed output	Confidence / sufficiency
Clean pnpm 11.10 install of the exact SDK commit	SDK core built from the pin using the exact tarball allowlist key	Proves a clean consumer can install the temporary Git dependency; final npm semver installation remains to be rerun after release
Browse lint/build	Formatting, ESLint, typecheck, manifest generation, and build passed	Proves the core types and Oclif adapters compile together
Browse full test suite	25/25 files and 368/368 tests passed	Covers Browse command, JSON, telemetry, error, and import contracts; mocks do not replace the live rows below
Functions contract suite	15/15 tests passed	Proves the thin adapters preserve Browse behavior and importing /core does not execute Commander
Workspace check	10/10 format/lint/typecheck tasks passed with 0 errors	Proves the stacked dependency does not break the containing workspace
Packed Browse artifact	Expected CLI files were present and the dependency resolved to the exact SDK commit	Proves the package tarball contains the CLI and records the tested dependency; it must not be published with that pin
Fresh Browse scaffold and local dev with real credentials	Managed runtime connected and returned Example Domain	Exercises scaffold installation, real session creation, local protocol, and cleanup on a public target
Browse publish and synchronous invoke	Cloud build and invocation completed with the expected result	Exercises archive, API, polling, and blocking invocation against the real Functions service
Browse async invoke followed by independent status lookup	Submission, status polling, and result completion passed	Exercises the real non-blocking and resume/status path
Cross-host compatibility using the exact SDK commit	Browse scaffold published by bb; bb scaffold published by Browse	Proves both CLI adapters consume compatible project/core contracts; final released-semver wiring remains to be rerun

Live validation used public starter behavior. Secrets, account identifiers, resource IDs, and connection URLs are intentionally omitted.

Browse release caveat

This stack targets v4-spike-cli. The current release workflow triggers only on pushes to main, and current main does not contain packages/cli, so merging this branch alone cannot publish browse.

Branch lineage is not the runtime blocker: Browse already aliases Stagehand v3 as stagehand-v3. The blocker is release orchestration/authentication.

Recommended path:

1. If v4-spike-cli will merge to main soon, release normally through Changesets after that merge.
2. Otherwise, add a narrowly scoped workflow_dispatch workflow on the default branch that accepts and validates an exact CLI branch SHA, checks it out, runs frozen install plus Browse lint/test/build/pack, versions the Browse changeset, and publishes only browse using trusted publishing.
3. Avoid an ad hoc local npm publish from the feature branch; it is technically possible but less auditable.

[changeset-bot]

🦋 Changeset detected

Latest commit: 8b191df

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
browse	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR