## Summary
Fixes#4065 - OpenAI reasoning tokens were being double-counted in
`_get_usage()`, inflating reported token counts by ~2x for all reasoning
models (o1, o3, o4-mini, etc.).
## Problem
The `_get_usage()` method was incorrectly adding `reasoning_tokens` to
`completion_tokens`:
```python
completion_tokens = response.usage.completion_tokens
if completion_token_details is not None:
reasoning_tokens = completion_token_details.reasoning_tokens
if reasoning_tokens is not None:
completion_tokens += reasoning_tokens # ← Double counting!
```
## Root Cause
According to OpenAI's API documentation, `completion_tokens` already
**includes** `reasoning_tokens` as a subset. This is explicitly stated
in the `CompletionTokensDetails` field description:
> reasoning tokens are "counted in the total completion tokens for
purposes of billing, output, and context window limits"
This differs from Google Gemini where `thinking_tokens` are reported
separately and need to be added.
## Solution
Removed the `reasoning_tokens` addition and used `completion_tokens`
directly, with a clarifying comment explaining the difference from
Gemini.
## Impact
- ✅ Fixes inflated cost calculations for users of o1, o1-pro, o3,
o3-mini, o3-pro, o4-mini
- ✅ Fixes inflated usage logging and telemetry
- ✅ Aligns with other OpenAI-compatible providers in the codebase
(OpenRouter, Vercel, Cerebras, Groq)
- ✅ No behavioral impact (token counts aren't used for budget limits or
context window management)
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes double-counting of OpenAI reasoning_tokens in _get_usage(), which
inflated completion token and cost numbers for reasoning models. Aligns
token reporting with OpenAI docs and fixes#4065.
- **Bug Fixes**
- Use response.usage.completion_tokens directly; remove added
reasoning_tokens.
- Corrects usage and cost logs for o1, o1-pro, o3, o3-mini, o3-pro,
o4-mini.
<sup>Written for commit 993a4c1f5b.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
OpenAI's completion_tokens already includes reasoning_tokens as a subset,
so adding them again was incorrectly inflating token counts by ~2x for
all reasoning models (o1, o3, o4-mini, etc.).
This aligns with other OpenAI-compatible providers (OpenRouter, Vercel,
Cerebras, Groq) which use completion_tokens directly.
Note: This is different from Google Gemini where thinking_tokens ARE
reported separately and need to be added.
Fixes#4065
The pipe-based stderr was causing cloudflared to get SIGPIPE when
the parent Python process exited (pipe closed). Now stderr goes to
a log file at ~/.browser-use/tunnels/<port>.log which cloudflared
can write to indefinitely without blocking or dying.
- Spawn cloudflared as daemon with start_new_session=True
- Track tunnels via PID files in ~/.browser-use/tunnels/ instead of memory
- Properly add --all flag to tunnel argparser (fixes unrecognized args error)
- Clean up stale PID files when tunnel process has died
This fixes the issue where cloudflared would become a zombie/defunct process
immediately after browser-use tunnel returned, causing 530 errors.
- Auto-install gum for beautiful interactive prompts
- Checkbox-style mode selection with arrow keys + space to select
- Styled headers and instructions
- Falls back to basic bash menu if gum install fails
Address review feedback: trust_env=False now only applies to localhost/127.0.0.1/::1.
Remote CDP URLs will still respect HTTP_PROXY/HTTPS_PROXY environment variables.
On Windows with HTTP_PROXY/HTTPS_PROXY env vars set, httpx respects
these for localhost requests, causing 502 responses when querying
the CDP /json/version endpoint.
Adding trust_env=False prevents httpx from using proxy env vars,
ensuring localhost CDP communication works regardless of system
proxy configuration.
Previously, `browser-use tunnel 3000` would start a session server with
the default browser mode (chromium), which poisoned subsequent
`--browser remote` commands with a mode mismatch error.
Now tunnel commands are handled directly in main.py without starting a
browser session:
npm run dev &
browser-use tunnel 3000 # No session created
browser-use --browser remote open <tunnel-url> # Works!
Changes:
- Move tunnel logic to standalone functions in tunnel_manager.py
- Handle tunnel commands in main.py before ensure_server()
- Tunnels persist across browser-use close (independent lifecycle)
- Add `browser-use tunnel stop --all` command
Breaking behavior change:
- `browser-use close` no longer stops tunnels
- Use `browser-use tunnel stop <port>` or `tunnel stop --all` explicitly
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When a session is started without --browser remote and a subsequent command
uses --browser remote, the CLI now errors with guidance instead of silently
using the local browser (which loses cloud features like live_url).
Code changes:
- Add session metadata file to track browser_mode per session
- Error only when remote requested but session is local
- Allow local-on-remote (user gets more features than requested)
- Clean up metadata on session close
SKILL.md improvements:
- Clarify that --browser remote only needed on FIRST command
- Add table showing session modes
- Add "What happens if you forget" section with error example
- Add troubleshooting entry for mode mismatch error
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When a session is started with --browser chromium and a subsequent command
uses --browser remote (or vice versa), the CLI now detects the mismatch and
provides actionable error guidance instead of silently using the wrong mode.
Changes:
- Add get_session_metadata_path() to track session config in temp files
- Write browser_mode, headed, profile to metadata on server start
- Check metadata in ensure_server() and error if modes don't match
- Clean up metadata file on session close
Example error:
Error: Session 'default' is running with --browser chromium,
but --browser remote was requested.
Options:
1. Use existing browser: browser-use --browser chromium <command>
2. Use different session: browser-use --browser remote --session other <command>
3. Close existing session: browser-use close
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Fixed JSON corruption in structured outputs by changing how the simple
judge records its note. When a schema is expected, the note is stored in
metadata instead of appended to extracted_content.
- **Bug Fixes**
- When output_model_schema is set, write the simple judge note to
result.metadata['simple_judge'] (initializing metadata if needed).
- Preserve previous behavior (append to extracted_content) when no
structured output is expected.
<sup>Written for commit 07817c2c5b.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
- Remove pycloudflared dependency from pyproject.toml
- Simplify tunnel_manager.py to just use shutil.which('cloudflared')
- Add install_cloudflared() to install.sh that downloads binary from
official Cloudflare GitHub releases based on platform/arch
- Update SKILL.md with manual cloudflared install instructions
- Update setup.py messages for missing cloudflared
install.sh supported platforms:
- Linux (x86_64, arm64) - full support, downloads binary to ~/.local/bin
- macOS (Intel, Apple Silicon) - full support, uses brew or direct download
- Windows WSL - works (treated as Linux)
- Native Windows - not supported (bash script), use manual install
## Summary
Fixes#3970
The LLM was typing literal placeholder names (e.g., `user_name`) instead
of wrapping them in `<secret>` tags (e.g.,
`<secret>user_name</secret>`), causing the password/sensitive data
replacement mechanism to fail.
## Changes
Updated
[_get_sensitive_data_description()](cci:1://file:///Users/ashishkumarcheruku/Desktop/BrowserUse/browser_use/agent/message_manager/service.py:372:1-401:11)
in
[browser_use/agent/message_manager/service.py](cci:7://file:///Users/ashishkumarcheruku/Desktop/BrowserUse/browser_use/agent/message_manager/service.py:0:0-0:0):
- Added clear "SENSITIVE DATA" header to draw attention
- Changed placeholder list format from Python list representation to
bullet points
- Added explicit "MUST" instruction emphasizing the required format
- Added a concrete example using the first actual placeholder name
- Added explanation that the system will replace tags with actual values
## Before
Here are placeholders for sensitive data: ['user_name', 'pass_word'] To
use them, write the placeholder name
## After
SENSITIVE DATA - Use these placeholders for secure input:
pass_word
user_name
IMPORTANT: When entering sensitive values, you MUST wrap the placeholder
name in tags. Example: To enter the value for "pass_word", use:
pass_word The system will automatically replace these tags with the
actual secret values.
## Testing
- All 10 existing sensitive_data tests pass
(`tests/ci/security/test_sensitive_data.py`)
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Clarifies sensitive-data guidance so placeholder names must be wrapped
in <secret> tags, preventing secret replacement failures and addressing
#3970.
- **Bug Fixes**
- Added a "SENSITIVE DATA" header and bullet list of placeholders.
- Added a MUST instruction with an example to wrap names in <secret>
tags.
- Explained that tags are auto-replaced with real secrets.
- Limited to _get_sensitive_data_description; synced with main, no
functional changes; all sensitive_data tests pass.
<sup>Written for commit f3ed2acb11.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
### Summary
This PR improves the robustness of sensitive data handling by allowing
the agent to recognize and replace placeholders even when the LLM
outputs them as literal strings without `<secret>` tags.
### Problem
In some cases (observed with certain LLMs), the model omits `<secret>`
tags and instead outputs the literal sensitive key name (e.g.
`user_name`, `pass_word`).
Previously, the library only scanned for tagged content, causing these
placeholder names to be typed into form fields instead of the actual
credentials.
### Solution
- Updated `Registry._replace_sensitive_data` in
`browser_use/tools/registry/service.py` to detect **exact string
matches** against registered sensitive data keys.
- Added support for **2FA / TOTP generation** for these literal matches.
- Preserved full backward compatibility with the existing tag-based
replacement logic.
### Impact
This prevents failed automation and accidental exposure of placeholder
names when LLMs "forget" to include `<secret>` tags, making credential
handling more reliable across different models.
### Related issue
Closes#3970
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Replaces exact literal secret names when the LLM omits <secret> tags,
including generating TOTP for bu_2fa_code. Stops placeholder strings
from being typed into fields and fixes#3970.
<sup>Written for commit f469617aa7.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
- New `tunnel` command: expose localhost ports via Cloudflare quick tunnels
(`bu tunnel 3000` → trycloudflare.com URL, idempotent, auto-cleanup on session close)
- New `skills/remote-browser/SKILL.md`: guides sandboxed agents through
cloud browser + tunnel workflow
- TunnelInfo dataclass on SessionInfo for tunnel lifecycle management
- Tunnel dispatch in both SessionServer and CLI arg parser
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When the agent runs multiple actions per step, steps where all actions
fail weren't being counted as failures, so the failure limit could never
be reached. Now, any step ending in an error counts as a failure. May
help with #3615.
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes failure counting for multi-action steps so the agent stops after
hitting the failure limit. Any step whose last action errors now
increments consecutive_failures, preventing the counter from being
skipped on multi-action error steps.
- **Bug Fixes**
- Count a step as a failure when the last result has an error,
regardless of action count.
- Prevents runaway loops where the failure limit was never reached.
<sup>Written for commit e1e170a5fd.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Redirect all logs to stderr to keep MCP stdio clean and avoid protocol
breakage. Set env vars early and adjust imports to stop early logs.
Fixes#2748.
- **Bug Fixes**
- Route all logs (app, CDP, MCP server) to stderr; MCP server runs at
WARNING.
- Print CLI addon warning to stderr.
- Set logging env vars before imports and reorder mcp/server imports to
prevent early logs.
<sup>Written for commit 53c1b0dfb9.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
Fixes: #3897
**The Problem**
When using browser-use with certain custom LLM proxies (configured via
ChatOpenAI
), the agent would crash unexpectedly during the execution loop. The
error traceback pointed to
browser_use/llm/openai/chat.py
with TypeError: 'NoneType' object is not subscriptable.
This happened because some proxies return a JSON response where the
choices field is either missing or explicitly set to None (likely due to
internal errors or non-standard formatting). The existing code assumed
response.choices always contained a valid list and attempted to access
response.choices[0] directly, causing the crash when the list was None.
**The Fix**
This PR modifies
browser_use/llm/openai/chat.py
to add robust validation for the LLM response structure.
**Identified the Failure Point:** Located the exact lines in
ainvoke
where response.choices[0] was accessed for both standard string
completions and structured output.
Added Guard Clauses: Implemented an explicit check: if not
response.choices:.
Improved Error Handling: Instead of letting the application crash with a
confusing Python TypeError, the code now raises a
**ModelProviderErro**r
with a specific message: "Model response missing 'choices' field. This
can happen with incompatible proxies."
This change allows the agent to handle these malformed proxy responses
gracefully, providing users with a clear error message that points to
the proxy configuration rather than a bug in the library code.
**Verification/ testing**
**Reproduction**: Created a reproduction script that mocked AsyncOpenAI
to return a ChatCompletion object with choices=None, successfully
replicating the TypeError.
**Validation**: Ran the same reproduction script with the fix applied;
confirmed that
ModelProviderError
was raised with the correct message.
**Regression Testing**: Verified that standard OpenAI usage remains
unaffected.
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fix crash when some OpenAI-compatible proxies return chat completions
without choices. We now validate choices in ainvoke and raise a clear
ModelProviderError (with base_url hint) instead of a TypeError;
structured-output calls no longer depend on schema injection.
- **Bug Fixes**
- Validate response.choices in both text and structured paths; if
missing/empty, raise ModelProviderError (502) with a base_url hint and
preserve status/message.
- Use the validated first choice for content and finish_reason; keep the
structured output parse check.
- Structured-output request runs even when add_schema_to_system_prompt
is false; removed a temporary debug regression test and reverted the
prior CI timeout change.
<sup>Written for commit 668f51ead9.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
Fix indentation so structured-output request executes even when add_schema_to_system_prompt is false; add regression tests for choices=null in both structured and non-structured paths.
Avoid indexing response.choices[0] when proxies return choices=null/empty; raise a clear ModelProviderError (with base_url hint) and use the validated first choice for content/finish_reason
Fixes#3970
The LLM was typing literal placeholder names (e.g., 'user_name') instead
of wrapping them in <secret> tags (e.g., '<secret>user_name</secret>').
Changes to _get_sensitive_data_description():
- Added clear 'SENSITIVE DATA' header to draw attention
- Changed placeholder list format from Python list to bullet points
- Added explicit 'MUST' instruction emphasizing the required format
- Added concrete example using the first actual placeholder name
- Added explanation that the system will replace tags with actual values
This makes it much clearer to the LLM that it needs to wrap placeholder
names in <secret> tags for the automatic replacement mechanism to work.
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Bumps package version from 0.11.8 to 0.11.9 in pyproject.toml to prepare
the next patch release.
<sup>Written for commit d795dbe0f8.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
ShawnPana