Fix webhook signature verification to use original body

[Spirou7]

Summary

• Fixed verifyWebhookEventSignature to compute signature using the original parsed JSON body instead of the Zod-validated output

Problem

The verifyWebhookEventSignature function was using event.data (the Zod-validated output) instead of json (the original parsed body) when computing the signature for verification. This caused signature verification failures because:

1. Browser Use Cloud signs the raw JSON body when sending webhooks
2. The SDK was signing the Zod-transformed output, which may differ from the original (e.g., due to type coercion, field stripping, or normalization)

Solution

Changed line 84 in src/wrapper/lib/webhooks.ts from:

body: event.data, // NOTE: We need to encrypt the entire body, not just the payload

To:

body: json, // Sign the original parsed body, not the Zod-transformed output

Test plan

• Existing webhook tests pass
• Manual testing confirms webhook signature verification now works correctly

🤖 Generated with Claude Code

---

Summary by cubic

Fixed webhook signature verification to use the original JSON body instead of the Zod-validated output. This matches Browser Use Cloud’s signing behavior and prevents verification failures.

^{Written for commit 113644f. Summary will update automatically on new commits.}

[cubic-dev-ai]

No issues found across 1 file