**2 issues found** across 10 files Confidence score: **3/5** - There is moderate merge risk: two medium-severity issues (6/10) with high confidence suggest concrete user-facing behavior problems rather than pure housekeeping. - In `packages/core/lib/v3/types/public/api.ts`, validation issues raised from `SessionStartRequestSchema` can be attached to incorrect paths because nested helpers use object-scoped `ctx`; this can mislead clients/UI about which fields actually failed. - In `packages/core/lib/v3/modelProviderOptions.ts`, error text interpolates unsanitized `modelName`, which can leak raw input into user-facing messages and reduce safety/consistency of error handling. - Pay close attention to `packages/core/lib/v3/types/public/api.ts` and `packages/core/lib/v3/modelProviderOptions.ts` - incorrect validation paths and unsanitized error-message interpolation are the main regression risks.

Prompt for AI agents (unresolved issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P2: Validation error paths are incorrect when triggered from `SessionStartRequestSchema`. The `ctx` is scoped to the `SessionStartRequest` object, but `addBedrockAuthIssues` and `getProviderConfigMismatchMessage` add issues with paths like `["providerConfig", "options", "region"]`. Since the data lives at `modelClientOptions.providerConfig.options.region`, error consumers won't be able to locate the offending field. Consider prefixing the paths with `"modelClientOptions"` when calling from `SessionStartRequestSchema`, or having `validateProviderConfig` accept a path prefix parameter. P2: Custom agent: **Exception and error message sanitization** User-facing error message reflects unsanitized raw `modelName` input via string interpolation. ```

Architecture diagram

```mermaid sequenceDiagram participant User participant SDK as Stagehand SDK (V3) participant Lib as modelProviderOptions participant API as Stagehand API Client participant Hosted as Stagehand Hosted API Note over User,Hosted: Session Initialization Flow User->>SDK: new Stagehand({ model: { providerOptions, ... } }) SDK->>Lib: normalizeClientOptionsForModel() Note right of Lib: NEW: Normalizes Bedrock/Vertex auth
into runtime options Lib-->>SDK: normalizedOptions SDK->>API: init({ modelClientOptions: normalizedOptions }) API->>Lib: toApiModelClientOptions() Note right of Lib: NEW: Serializes SDK options to
API "providerConfig" wire format Lib-->>API: apiModelClientOptions API->>API: CHANGED: Store sessionModelConfig Note right of API: Retains provider-native auth for
subsequent hosted actions alt NEW: Bedrock/Vertex with provider auth API->>Hosted: POST /session/start (body: { modelClientOptions }) Note left of Hosted: Request sent WITHOUT x-model-api-key header else Standard API Key Auth API->>Hosted: POST /session/start (header: x-model-api-key) end Hosted-->>API: 200 OK (sessionId) Note over User,Hosted: Execution Flow (e.g., act / extract / observe) User->>SDK: act({ input }) SDK->>API: act({ input }) API->>API: NEW: ensureModelConfig() Note right of API: Injects stored sessionModelConfig if
no per-call model override exists API->>Hosted: POST /act (body: { model: sessionModelConfig, ... }) Note left of Hosted: Ensures provider-native auth persists
on every hosted action Hosted-->>API: Action Results API-->>SDK: Results SDK-->>User: Results ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review, or [fix all with cubic](https://www.cubic.dev/action/fix/pr/browserbase/stagehand/2031/ai_pr_review_1776976065002_b7a07856-ea36-4c32-a7ad-0d73cff4dcd7?entrySource=github_ui_to_cubic_ui).}