fix: track SDK language in Go Browserbase session metadata

[shrey150]

Summary

• tag Browserbase sessions created by the Go SDK with authoritative stagehand and stagehand_sdk_language user metadata, mirroring the TypeScript SDK
• preserve caller-provided session metadata while preventing the attribution fields from being spoofed
• add a unit test that captures the outgoing session-create request and asserts spoofed attribution keys are overridden, plus update the existing typed-request round-trip test

Why

Stagehand v3 identifies its SDK language with the x-language request header. V4 no longer routes SDK work through the hosted Stagehand API, so Browserbase session metadata is the durable, queryable equivalent for cloud sessions. #2467 added this for the TypeScript and Python SDKs. The Go SDK has since landed on v4-spike, so this PR completes the follow-up for Go.

E2E Test Matrix

Command / flow	Observed output	Confidence / sufficiency
Build the current server extension, then run the Go generator check and embedded-extension check	Both freshness checks passed after rebasing onto the current v4-spike.	Confirms the PR no longer inherits the generated-model or embedded-extension drift that previously failed CI.
Go CI path: gofmt, vet, example compilation, package tests with local Chrome, generator tests, and build	All commands passed; the Stagehand package and extension packages passed their test suites.	Covers the complete Go CI path against the rebased branch.
`go test -race -run 'TestStagehandSessionMetadata	TestBrowserbaseSessionClientCreateUsesTypedEndpoint' .`	Passed under the race detector.
BROWSERBASE_SMOKE=1 go test -run TestStagehandBrowserbaseIntegration → create a real Browserbase session through the Go SDK → retrieve it through the Browserbase API	Retrieved {"stagehand":"true","stagehand_sdk_language":"go","suite":"stagehand-v4-go-public-smoke"}; the session was released.	Proves the exact Go attribution behavior is durable and queryable on a live Browserbase session.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4b2b857

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant GoSDK as BrowserbaseSessionClient
    participant Metadata as stagehandSessionMetadata
    participant BBAPI as Browserbase API

    Note over GoSDK,BBAPI: Session creation with Stagehand attribution

    GoSDK->>GoSDK: caller provides userMetadata<br/>(may contain spoofed "stagehand" keys)
    GoSDK->>Metadata: stagehandSessionMetadata(userMetadata)
    Metadata->>Metadata: clone userMetadata map
    Metadata->>Metadata: merge authoritative keys:<br/>"stagehand"="true",<br/>"stagehand_sdk_language"="go"
    Note over Metadata: Authoritative keys always win –<br/>any caller values for these keys are overridden
    Metadata-->>GoSDK: merged metadata
    GoSDK->>BBAPI: POST /sessions with merged userMetadata
    alt Authoritative keys preserved
        BBAPI-->>GoSDK: Session created with attribution
    else Spoofed caller keys present
        Note over GoSDK: Spoofed keys silently overwritten<br/>(no error)
    end

Loading

_{Re-trigger cubic}