Skip to content

fix(core): normalize URLs in ActCache key derivation (#2190) - #2233

Merged
seanmcguire12 merged 1 commit into
mainfrom
evals/external-contrib-yawbtng
Jun 10, 2026
Merged

fix(core): normalize URLs in ActCache key derivation (#2190)#2233
seanmcguire12 merged 1 commit into
mainfrom
evals/external-contrib-yawbtng

Conversation

@seanmcguire12

@seanmcguire12 seanmcguire12 commented Jun 10, 2026

Copy link
Copy Markdown
Member

thanks for the contribution @yawbtng !

Closes #2189.

why

ActCache.buildActCacheKey
(packages/core/lib/v3/cache/ActCache.ts:184) hashes the page URL verbatim from page.url() with no normalization. URLs that are semantically equivalent — same origin, path, and set of query parameters — produce different cache keys whenever the parameters appear in a different order. The cache silently misses, triggering an LLM call where one shouldn't be needed.

This is pervasive on real-world URLs: e-commerce links, ad funnels, anywhere utm_* / session params drift between visits.

| First run | Second run | Same page? | Cache hits today? | | --- | --- | --- | --- |
| ?id=42&utm_source=email | ?utm_source=email&id=42 | yes | no | | ?ref=home&page=2 | ?page=2&ref=home | yes | no |

what changed

  • New normalizeUrlForCacheKey in cache/utils.ts: parses the URL, calls URLSearchParams.sort(), reserializes. Falls back to the raw input if the URL is unparseable ("", about:blank-like values).
  • ActCache.prepareContext passes the normalized URL into buildActCacheKey while the stored entry.url still holds the raw URL (so on-disk cache files remain debuggable).
  • New unit test packages/core/tests/unit/act-cache-url-normalize.test.ts covering: sort behavior, equivalent URLs producing identical output, fragment preservation, duplicate-key relative-order preservation, fallback paths.

design notes

The normalizer is intentionally conservative — only sorts parameters. Out of scope here, but candidates for follow-ups:

  • Tracking-param stripping (utm_*, fbclid, gclid, etc.) — requires opinions on what counts as tracking; could break intentional differentiation, e.g. a customer that uses ?ref=X as a meaningful state.
  • Fragment stripping — fragments often indicate distinct views in SPAs, so removing them could lose intent.
  • Trailing-slash normalization — some servers treat them differently.

Each of those could land separately once the conservative pass is in.

compatibility

Strict superset of current cache hits — no URL that hits the cache today will miss after this change. URLs that miss today because of param reordering will now hit. The on-disk cache key for any URL containing query params changes; old entries become unreachable (don't break anything, just don't get used), and the next run rewrites them with the new key.

test plan

  • pnpm run build:esm && pnpm exec vitest run --config vitest.esm.config.mjs dist/esm/tests/unit/act-cache-url-normalize.test.js — 9/9 pass.
  • No public API changes; normalizeUrlForCacheKey is exported for testability but lives under cache/ and isn't re-exported from the SDK root.
  • Changeset bundled (@browserbasehq/stagehand patch).

Found while reading ActCache.ts to understand the self-healing flow — happy to follow up with the tracking-param strip or fragment handling as a separate PR once this lands.

---

Summary by cubic

Normalize URLs in ActCache key derivation so query-parameter order no longer creates different cache keys, increasing hit rate and avoiding extra LLM calls. Closes #2189.

  • Bug Fixes

  • Added normalizeUrlForCacheKey in cache/utils.ts to sort query params via URLSearchParams.sort().

  • prepareContext now hashes the normalized URL; stored entry.url stays raw for debugging.

  • Preserves fragments and duplicate-key order; passes through empty/unparseable/about:blank URLs.

    • Added unit tests for sort behavior and equivalence cases.
  • Migration

  • Cache keys for URLs with query params change; existing on-disk entries won’t be used and will regenerate on next run.

Written for commit b98838e. Summary will update on new commits.

Review in cubic

why

what changed

test plan

Closes #2189.

## why

`ActCache.buildActCacheKey`
(`packages/core/lib/v3/cache/ActCache.ts:184`) hashes the page URL
verbatim from `page.url()` with no normalization. URLs that are
semantically equivalent — same origin, path, and set of query parameters
— produce different cache keys whenever the parameters appear in a
different order. The cache silently misses, triggering an LLM call where
one shouldn't be needed.

This is pervasive on real-world URLs: e-commerce links, ad funnels,
anywhere `utm_*` / session params drift between visits.

| First run | Second run | Same page? | Cache hits today? |
| --- | --- | --- | --- |
| `?id=42&utm_source=email` | `?utm_source=email&id=42` | yes | no |
| `?ref=home&page=2` | `?page=2&ref=home` | yes | no |

## what changed

- New `normalizeUrlForCacheKey` in `cache/utils.ts`: parses the URL,
calls `URLSearchParams.sort()`, reserializes. Falls back to the raw
input if the URL is unparseable (`""`, `about:blank`-like values).
- `ActCache.prepareContext` passes the normalized URL into
`buildActCacheKey` while the stored `entry.url` still holds the raw URL
(so on-disk cache files remain debuggable).
- New unit test
`packages/core/tests/unit/act-cache-url-normalize.test.ts` covering:
sort behavior, equivalent URLs producing identical output, fragment
preservation, duplicate-key relative-order preservation, fallback paths.

## design notes

The normalizer is intentionally conservative — **only** sorts
parameters. Out of scope here, but candidates for follow-ups:

- **Tracking-param stripping** (`utm_*`, `fbclid`, `gclid`, etc.) —
requires opinions on what counts as tracking; could break intentional
differentiation, e.g. a customer that uses `?ref=X` as a meaningful
state.
- **Fragment stripping** — fragments often indicate distinct views in
SPAs, so removing them could lose intent.
- **Trailing-slash normalization** — some servers treat them
differently.

Each of those could land separately once the conservative pass is in.

## compatibility

Strict superset of current cache hits — no URL that hits the cache today
will miss after this change. URLs that miss today because of param
reordering will now hit. The on-disk cache key for any URL containing
query params changes; old entries become unreachable (don't break
anything, just don't get used), and the next run rewrites them with the
new key.

## test plan

- [x] `pnpm run build:esm && pnpm exec vitest run --config
vitest.esm.config.mjs
dist/esm/tests/unit/act-cache-url-normalize.test.js` — 9/9 pass.
- [x] No public API changes; `normalizeUrlForCacheKey` is exported for
testability but lives under `cache/` and isn't re-exported from the SDK
root.
- [x] Changeset bundled (`@browserbasehq/stagehand` patch).

Found while reading `ActCache.ts` to understand the self-healing flow —
happy to follow up with the tracking-param strip or fragment handling as
a separate PR once this lands.

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Normalize URLs in `ActCache` key derivation so query-parameter order no
longer creates different cache keys, increasing hit rate and avoiding
extra LLM calls. Closes #2189.

- **Bug Fixes**
- Added `normalizeUrlForCacheKey` in `cache/utils.ts` to sort query
params via `URLSearchParams.sort()`.
- `prepareContext` now hashes the normalized URL; stored `entry.url`
stays raw for debugging.
- Preserves fragments and duplicate-key order; passes through
empty/unparseable/`about:blank` URLs.
  - Added unit tests for sort behavior and equivalence cases.

- **Migration**
- Cache keys for URLs with query params change; existing on-disk entries
won’t be used and will regenerate on next run.

<sup>Written for commit b98838e.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/browserbase/stagehand/pull/2190?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
@changeset-bot

changeset-bot Bot commented Jun 10, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: cc07727

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@browserbasehq/stagehand Patch
@browserbasehq/stagehand-evals Patch
@browserbasehq/stagehand-server-v3 Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.
Architecture diagram
sequenceDiagram
    participant Page as Page
    participant ActCache as ActCache
    participant CacheStorage as CacheStorage
    participant Utils as cache/utils

    Note over Page,Utils: NEW: Cache key derivation with URL normalization

    Page->>ActCache: prepareContext(page, instruction, variableKeys)
    ActCache->>ActCache: sanitizeInstruction(instruction)
    ActCache->>Utils: safeGetPageUrl(page)
    Utils-->>ActCache: rawUrl (e.g. "https://example.com/?b=2&a=1")
    ActCache->>Utils: normalizeUrlForCacheKey(rawUrl)
    
    alt URL is parseable
        Utils->>Utils: new URL(rawUrl)
        Utils->>Utils: url.searchParams.sort()
        Utils-->>ActCache: normalizedUrl (e.g. "https://example.com/?a=1&b=2")
    else URL is empty/unparseable
        Utils-->>ActCache: rawUrl (unchanged)
    end

    ActCache->>ActCache: buildActCacheKey(sanitizedInstruction, normalizedUrl, variableKeys)
    ActCache->>CacheStorage: get(cacheKey)
    
    alt Cache hit
        CacheStorage-->>ActCache: cached entry (entry.url = rawUrl for debugging)
    else Cache miss
        CacheStorage-->>ActCache: null
        ActCache->>ActCache: Execute LLM call and store result
        ActCache->>CacheStorage: set(cacheKey, result, rawUrl)
    end
    
    ActCache-->>Page: return context with cached or fresh result
Loading

Re-trigger cubic

@seanmcguire12
seanmcguire12 merged commit 8d7d414 into main Jun 10, 2026
230 checks passed
seanmcguire12 pushed a commit that referenced this pull request Jun 19, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @browserbasehq/stagehand@3.6.0

### Minor Changes

- [#2178](#2178)
[`c49a3fc`](c49a3fc)
Thanks [@seanmcguire12](https://github.com/seanmcguire12)! - add support
for WebMCP

### Patch Changes

- [#2217](#2217)
[`147e310`](147e310)
Thanks [@monadoid](https://github.com/monadoid)! - Add Azure OpenAI
Microsoft Entra ID model auth support.

- [#2231](#2231)
[`cf3603d`](cf3603d)
Thanks [@miguelg719](https://github.com/miguelg719)! - Add
claude-fable-5 support: native structured outputs via the
@ai-sdk/anthropic bump, adaptive thinking (including the new "xhigh"
effort) on the agent path, the API's built-in server-side refusal
fallback to claude-opus-4-8, and auto tool choice for the final done
call on models that reject forced tool use.

- [#2233](#2233)
[`8d7d414`](8d7d414)
Thanks [@seanmcguire12](https://github.com/seanmcguire12)! - Normalize
URLs in `ActCache` key derivation by sorting query parameters before
hashing. Semantically equivalent URLs that differ only in parameter
order (e.g. `?utm_source=email&id=42` vs `?id=42&utm_source=email`) now
hit the cache instead of silently missing. Fragments and duplicate keys
are preserved.

- [#2229](#2229)
[`fd42e65`](fd42e65)
Thanks [@seanmcguire12](https://github.com/seanmcguire12)! - launch
local browser with --enable-features=WebMCPTesting,DevToolsWebMCPSupport
by default

- [#2220](#2220)
[`a64c6b7`](a64c6b7)
Thanks [@monadoid](https://github.com/monadoid)! - Fix
Stagehand-generated shadow-root XPath resolution so deterministic
actions can target elements inside web components.

- [#2132](#2132)
[`ed3e566`](ed3e566)
Thanks [@miguelg719](https://github.com/miguelg719)! - Add canonical
verifier evidence normalization for screenshots and text signals without
requiring image dependencies in core installs.

- [#2133](#2133)
[`840aac8`](840aac8)
Thanks [@miguelg719](https://github.com/miguelg719)! - Add the
rubric-based verifier engine with normalized public rubric output and
bounded failure-step parsing.

## @browserbasehq/stagehand-evals@2.0.3

### Patch Changes

- Updated dependencies
\[[`147e310`](147e310),
[`cf3603d`](cf3603d),
[`8d7d414`](8d7d414),
[`fd42e65`](fd42e65),
[`a64c6b7`](a64c6b7),
[`c49a3fc`](c49a3fc),
[`ed3e566`](ed3e566),
[`840aac8`](840aac8)]:
    -   @browserbasehq/stagehand@3.6.0

## @browserbasehq/stagehand-server-v3@3.7.1

### Patch Changes

- [#2217](#2217)
[`147e310`](147e310)
Thanks [@monadoid](https://github.com/monadoid)! - Add Azure OpenAI
Microsoft Entra ID model auth support.

- Updated dependencies
\[[`147e310`](147e310),
[`cf3603d`](cf3603d),
[`8d7d414`](8d7d414),
[`fd42e65`](fd42e65),
[`a64c6b7`](a64c6b7),
[`c49a3fc`](c49a3fc),
[`ed3e566`](ed3e566),
[`840aac8`](840aac8)]:
    -   @browserbasehq/stagehand@3.6.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@yawbtng

yawbtng commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

of course! glad I could help!

felipeofdev-ai pushed a commit to felipeofdev-ai/stagehand that referenced this pull request Aug 4, 2026
… (browserbase#2233)

thanks for the contribution @yawbtng !

Closes browserbase#2189.

## why

`ActCache.buildActCacheKey`
(`packages/core/lib/v3/cache/ActCache.ts:184`) hashes the page URL
verbatim from `page.url()` with no normalization. URLs that are
semantically equivalent — same origin, path, and set of query parameters
— produce different cache keys whenever the parameters appear in a
different order. The cache silently misses, triggering an LLM call where
one shouldn't be needed.

This is pervasive on real-world URLs: e-commerce links, ad funnels,
anywhere `utm_*` / session params drift between visits.

| First run | Second run | Same page? | Cache hits today? | | --- | ---
| --- | --- |
| `?id=42&utm_source=email` | `?utm_source=email&id=42` | yes | no | |
`?ref=home&page=2` | `?page=2&ref=home` | yes | no |

## what changed

- New `normalizeUrlForCacheKey` in `cache/utils.ts`: parses the URL,
calls `URLSearchParams.sort()`, reserializes. Falls back to the raw
input if the URL is unparseable (`""`, `about:blank`-like values).
- `ActCache.prepareContext` passes the normalized URL into
`buildActCacheKey` while the stored `entry.url` still holds the raw URL
(so on-disk cache files remain debuggable).
- New unit test
`packages/core/tests/unit/act-cache-url-normalize.test.ts` covering:
sort behavior, equivalent URLs producing identical output, fragment
preservation, duplicate-key relative-order preservation, fallback paths.

## design notes

The normalizer is intentionally conservative — **only** sorts
parameters. Out of scope here, but candidates for follow-ups:

- **Tracking-param stripping** (`utm_*`, `fbclid`, `gclid`, etc.) —
requires opinions on what counts as tracking; could break intentional
differentiation, e.g. a customer that uses `?ref=X` as a meaningful
state.
- **Fragment stripping** — fragments often indicate distinct views in
SPAs, so removing them could lose intent.
- **Trailing-slash normalization** — some servers treat them
differently.

Each of those could land separately once the conservative pass is in.

## compatibility

Strict superset of current cache hits — no URL that hits the cache today
will miss after this change. URLs that miss today because of param
reordering will now hit. The on-disk cache key for any URL containing
query params changes; old entries become unreachable (don't break
anything, just don't get used), and the next run rewrites them with the
new key.

## test plan

- [x] `pnpm run build:esm && pnpm exec vitest run --config
vitest.esm.config.mjs
dist/esm/tests/unit/act-cache-url-normalize.test.js` — 9/9 pass.
- [x] No public API changes; `normalizeUrlForCacheKey` is exported for
testability but lives under `cache/` and isn't re-exported from the SDK
root.
- [x] Changeset bundled (`@browserbasehq/stagehand` patch).

Found while reading `ActCache.ts` to understand the self-healing flow —
happy to follow up with the tracking-param strip or fragment handling as
a separate PR once this lands.

<!-- This is an auto-generated description by cubic. --> ---
## Summary by cubic
Normalize URLs in `ActCache` key derivation so query-parameter order no
longer creates different cache keys, increasing hit rate and avoiding
extra LLM calls. Closes browserbase#2189.

- **Bug Fixes**
- Added `normalizeUrlForCacheKey` in `cache/utils.ts` to sort query
params via `URLSearchParams.sort()`.
- `prepareContext` now hashes the normalized URL; stored `entry.url`
stays raw for debugging.
- Preserves fragments and duplicate-key order; passes through
empty/unparseable/`about:blank` URLs.
  - Added unit tests for sort behavior and equivalence cases.

- **Migration**
- Cache keys for URLs with query params change; existing on-disk entries
won’t be used and will regenerate on next run.

<sup>Written for commit b98838e.
Summary will update on new commits.</sup>

<a

href="https://cubic.dev/pr/browserbase/stagehand/pull/2190?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

# why

# what changed

# test plan
felipeofdev-ai pushed a commit to felipeofdev-ai/stagehand that referenced this pull request Aug 4, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @browserbasehq/stagehand@3.6.0

### Minor Changes

- [browserbase#2178](browserbase#2178)
[`c49a3fc`](browserbase@c49a3fc)
Thanks [@seanmcguire12](https://github.com/seanmcguire12)! - add support
for WebMCP

### Patch Changes

- [browserbase#2217](browserbase#2217)
[`147e310`](browserbase@147e310)
Thanks [@monadoid](https://github.com/monadoid)! - Add Azure OpenAI
Microsoft Entra ID model auth support.

- [browserbase#2231](browserbase#2231)
[`cf3603d`](browserbase@cf3603d)
Thanks [@miguelg719](https://github.com/miguelg719)! - Add
claude-fable-5 support: native structured outputs via the
@ai-sdk/anthropic bump, adaptive thinking (including the new "xhigh"
effort) on the agent path, the API's built-in server-side refusal
fallback to claude-opus-4-8, and auto tool choice for the final done
call on models that reject forced tool use.

- [browserbase#2233](browserbase#2233)
[`8d7d414`](browserbase@8d7d414)
Thanks [@seanmcguire12](https://github.com/seanmcguire12)! - Normalize
URLs in `ActCache` key derivation by sorting query parameters before
hashing. Semantically equivalent URLs that differ only in parameter
order (e.g. `?utm_source=email&id=42` vs `?id=42&utm_source=email`) now
hit the cache instead of silently missing. Fragments and duplicate keys
are preserved.

- [browserbase#2229](browserbase#2229)
[`fd42e65`](browserbase@fd42e65)
Thanks [@seanmcguire12](https://github.com/seanmcguire12)! - launch
local browser with --enable-features=WebMCPTesting,DevToolsWebMCPSupport
by default

- [browserbase#2220](browserbase#2220)
[`a64c6b7`](browserbase@a64c6b7)
Thanks [@monadoid](https://github.com/monadoid)! - Fix
Stagehand-generated shadow-root XPath resolution so deterministic
actions can target elements inside web components.

- [browserbase#2132](browserbase#2132)
[`ed3e566`](browserbase@ed3e566)
Thanks [@miguelg719](https://github.com/miguelg719)! - Add canonical
verifier evidence normalization for screenshots and text signals without
requiring image dependencies in core installs.

- [browserbase#2133](browserbase#2133)
[`840aac8`](browserbase@840aac8)
Thanks [@miguelg719](https://github.com/miguelg719)! - Add the
rubric-based verifier engine with normalized public rubric output and
bounded failure-step parsing.

## @browserbasehq/stagehand-evals@2.0.3

### Patch Changes

- Updated dependencies
\[[`147e310`](browserbase@147e310),
[`cf3603d`](browserbase@cf3603d),
[`8d7d414`](browserbase@8d7d414),
[`fd42e65`](browserbase@fd42e65),
[`a64c6b7`](browserbase@a64c6b7),
[`c49a3fc`](browserbase@c49a3fc),
[`ed3e566`](browserbase@ed3e566),
[`840aac8`](browserbase@840aac8)]:
    -   @browserbasehq/stagehand@3.6.0

## @browserbasehq/stagehand-server-v3@3.7.1

### Patch Changes

- [browserbase#2217](browserbase#2217)
[`147e310`](browserbase@147e310)
Thanks [@monadoid](https://github.com/monadoid)! - Add Azure OpenAI
Microsoft Entra ID model auth support.

- Updated dependencies
\[[`147e310`](browserbase@147e310),
[`cf3603d`](browserbase@cf3603d),
[`8d7d414`](browserbase@8d7d414),
[`fd42e65`](browserbase@fd42e65),
[`a64c6b7`](browserbase@a64c6b7),
[`c49a3fc`](browserbase@c49a3fc),
[`ed3e566`](browserbase@ed3e566),
[`840aac8`](browserbase@840aac8)]:
    -   @browserbasehq/stagehand@3.6.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

core(cache): ActCache key derivation isn't URL-normalized, causing silent cache misses

3 participants