Merged
Conversation
There was a problem hiding this comment.
1 issue found across 3 files
Confidence score: 3/5
- Variable replacement in
stagehand/handlers/act_handler.pynow does bare substring matching, which can unintentionally corrupt arguments (e.g., "id" inside "valid"), creating a concrete risk of incorrect behavior at runtime. - Severity is moderate-high (7/10) with a clear user-facing impact, so there’s some risk to merge without adjustment.
- Pay close attention to
stagehand/handlers/act_handler.py- substring matching can alter unintended parts of arguments.
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="stagehand/handlers/act_handler.py">
<violation number="1" location="stagehand/handlers/act_handler.py:99">
P1: Removing the `%` delimiters from variable replacement causes bare substring matching, which can unintentionally corrupt arguments. For example, a variable key `"id"` would match inside `"valid"` → `"val123"`. Consider trying `%key%` first for backward compat, then falling back to bare `key`:
```python
replaced = str(arg)
if f"%{key}%" in replaced:
replaced = replaced.replace(f"%{key}%", str(value))
else:
replaced = replaced.replace(f"{key}", str(value))
(Note: the nested for key, value loop also produces len(args) × len(variables) items instead of applying all substitutions per arg — a pre-existing issue worth fixing alongside this.)
</details>
<details>
<summary>Architecture diagram</summary>
```mermaid
sequenceDiagram
participant Client
participant AH as ActHandler
participant Browser as Browser Instance
Client->>AH: act(options)
Note over AH: Check for dynamic variables
opt if variables provided in options
loop for each argument in element_to_act_on.arguments
loop for each key, value in variables
AH->>AH: CHANGED: String replacement logic
Note right of AH: Now matches "key" instead of "%key%"
AH->>AH: Map variable value into argument string
end
end
end
AH->>Browser: Execute action with hydrated arguments
Browser-->>AH: Action result
AH-->>Client: Return ActResult (success/fail)
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
shrey150
approved these changes
Feb 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Variable values were only being replaced if the LLM replied with the percentage sign wrapped values
%key%. This PR addresses that and replaces justkeysuggested valuesSummary by cubic
Fix variable replacement in actHandler so plain keys are substituted, not only %key% tokens. This ensures suggested values populate element arguments reliably.
Written for commit 1350abe. Summary will update on new commits. Review in cubic