CLI: Update SDK to 9a6636d (v0.91.0) and add new commands/flags - #215
Merged
Conversation
Updates github.com/kernel/kernel-go-sdk to v0.86.0 (b5ea2f3dee2cbb2af9001e4558a28a807d31aeb3). A full enumeration of all 127 api.md methods against the CLI command tree found no missing commands. Enumerating every *Params field against every command's flags surfaced a set of filter/sort/pagination params the CLI never exposed; this closes those. New flags: - kernel api-keys list: --name, --query, --status, --include-deleted (deprecated alias for --status all), --sort-by, --sort-direction. Adds a Deleted At column when the filter can return deleted keys, matching `browsers list`. - kernel projects list: --page, --per-page, --name, --query. This command previously had no flags at all and always returned the API's default page. Uses the page-based pagination UX with a footer, as in `app list`. - kernel browser-pools list: --name, --query - kernel extensions list: --name, --query - kernel proxies list: --name, --query - kernel profiles list: --name - kernel auth connections list: --query - kernel credentials list: --query - kernel credential-providers list: --query - kernel deploy history: --query - kernel invoke history: --query - kernel browser-pools acquire: --start-url (BrowserPoolAcquireParams.StartURL) - kernel browsers telemetry events: --order asc|desc (BrowserTelemetryEventsParams.Order), rejecting `--order desc --since` locally since the endpoint 400s on that combination. SDK 0.86.0 changes: - ManagedAuthField.ReplaceExisting is now surfaced by `auth connections get` (as a `replace-existing` field marker) and `auth connections follow`, so it is visible before running `submit`. - ProjectLimits.MaxPooledSessions doc-only deprecation; no CLI change needed (the flag already exists and the API rejects it). Also forwards `browsers create --pool-id/--pool-name --start-url` through to the acquire call instead of warning and dropping it. start_url is a per-lease override on BrowserPoolAcquireParams, so it now sits alongside name/tag/telemetry/timeout in poolLeaseAllowedFlags. Tested against the live API: - api-keys list --status all --sort-by name --sort-direction asc (verified sort order and Deleted At population), --query, --include-deleted, and --sort-by/--sort-direction/--status validation errors - projects list --per-page 3 / --page 2 (footer + Next hint), --name, --query - --name and --query on proxies/extensions/browser-pools/profiles list - --query on credentials/credential-providers/auth connections list, deploy history, invoke history - browsers telemetry events --order desc (returned seq 22->18 vs asc 1->5) and the --order desc --since / --order bogus validation errors - browser-pools acquire --start-url and browsers create --pool-id --start-url (API echoed start_url on both) - go build, go vet, and go test ./... all pass Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Bump github.com/kernel/kernel-go-sdk to v0.86.1-0.20260804210355-b94cd585bac0 (commit b94cd58). The new SDK commit is byte-identical to v0.86.0 in module content -- the two upstream commits only touch CI promotion workflows, which are not part of the Go module. A full enumeration of all 127 SDK methods in api.md against the CLI command tree, and of all 95 *Params structs (345 fields, including nested unions) against every CLI flag, found no coverage gaps. Also fix the pagination footer hint in `kernel profiles list`, which suggested `kernel profile list` (singular, not a real command). Tested: go build ./..., go vet ./..., go test ./... (all pass); smoke-tested `kernel browsers list`, `kernel profiles list`, and `kernel profiles list --per-page 3` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Target SDK commit 9e39767e809b04f0786fb17377eb800fa624bddc contains no API
changes: it adds only .github/workflows/stlc-{promote,sync}.yml on top of
v0.86.0. `git diff v0.86.0..9e39767` touches zero .go files and no api.md.
The SHA is also not resolvable as a module version on its own -- it exists
only on the staging repo's main, so `go get 9e39767` fails with "unknown
revision". go.mod needs no change here: the preceding commit already moved it
to v0.86.1-0.20260804210355-b94cd585bac0, and b94cd58 is a direct child of
9e39767, so that pseudo-version already contains this target commit.
Coverage was re-enumerated from scratch anyway rather than trusting the
empty diff. All 127 methods in api.md map to an existing command; the seven
x-cli-skip endpoints in openapi.yaml (auth connections exchange, audit-log
export destinations) are absent from the SDK, so nothing to skip. Every
*Params field was diffed against every command's flags, including expanding
the embedded request structs (ManagedAuth*, CreateCredential*, CreateProject,
Update*Limits, CreateCredentialProvider*) and the ProxyNewParamsConfig union
variants, which the field-name comparison alone hides.
That surfaced one real gap, pre-existing rather than new in this bump:
- kernel audit-logs download: --format jsonl.gz|jsonl
(AuditLogExportChunkParams.Format). The format was hardcoded to jsonl.gz,
so uncompressed export was unreachable. The default output filename now
derives its extension from the format instead of always ending .jsonl.gz.
Two other unmatched fields were checked and are correctly not flags:
- BrowserCurlParams.ResponseEncoding: `browsers curl` does not call the SDK
Curl method at all. It streams raw bytes over the browser's HTTPClient,
which is already binary-safe, making the JSON-transport encoding moot.
- AuditLogListParams.PageToken / AuditLogExportChunkParams.Cursor: internal
pagination, driven by response headers.
Tested against the live API:
- audit-logs download --format jsonl (25-day window): 74 chunks, 3,669,435
rows, wrote audit-logs-20260710-20260804.jsonl; `file` reports NDJSON and
the lines parse as JSON.
- audit-logs download (default): wrote audit-logs-20260803-20260804.jsonl.gz;
gunzip yields 109,526 lines, matching the reported row count.
- audit-logs download --format jsonl.gz --to explicit.jsonl.gz: byte-identical
size to the default run.
- audit-logs download --format csv: rejected locally with
"invalid --format value: csv".
- go build ./... and go test ./... pass, before and after rebasing onto the
b94cd58 go.mod bump.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.1-0.20260805130902-f0262729f366 (commit f026272). The SDK diff between b94cd58 and f026272 is empty for api.md and all Go source files -- the only change in that range is a CI workflow file (.github/workflows/stlc-promote.yml). No new methods, no new param fields, so no CLI commands or flags were added. Coverage verification: - Enumerated all 127 SDK methods from api.md; every one has a corresponding CLI command. - Enumerated all 95 SDK *Params structs and their fields, diffed against all 205 CLI flags. Every remaining discrepancy resolved to a naming difference (--tag vs Tags, --kiosk vs KioskMode, --bypass-host vs BypassHosts, --env vs EnvVars), a positional argument, an embedded request-body struct, or a path parameter. - BrowserCurlParams.ResponseEncoding remains intentionally unexposed: `kernel browsers curl` bypasses the SDK Curl method and streams raw bytes through the browser's HTTP client, so response encoding does not apply. Tested: go build ./..., go vet ./..., go test ./... (all pass); smoke-tested `browsers list --limit 3` and `app list --per-page 2` against the live API -- both return expected output and the app list pagination footer renders correctly.
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to v0.86.1-0.20260805143436-f6072746e884 (kernel/kernel-go-sdk@f607274). The SDK diff between f026272 and f607274 contains no changes to api.md or any Go source file - f607274 is the stainless release merge commit and f026272 was a CI-only change. No new methods, params, or fields. Coverage analysis: performed a full enumeration anyway. All 126 SDK methods in api.md map to existing CLI commands, and every field of every *Params struct maps to an existing flag. The 7 endpoints marked x-cli-skip in openapi.yaml (auth connection exchange, audit-log export destinations) are absent from the SDK surface, as expected. One intentional non-gap: BrowserCurlParams.ResponseEncoding has no flag because `kernel browsers curl` bypasses the Browsers.Curl SDK method and streams raw bytes through the browser's HTTP client, so the base64 JSON transport option does not apply. Tested: go build ./..., go vet ./..., go test ./... (all pass), plus live API smoke tests of profiles list, browsers list, proxies list, api-keys list against the rebuilt binary. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to a42a4e3500ad02f7089f2903435d45ae907a1ff8.
The SDK adds telemetry.export.otlp (destination by id or name, plus an
enabled toggle) to every schema that embeds the shared telemetry request
config. Exposes it as --telemetry-export-otlp on the endpoints that
actually honor it:
- browsers create
- auth connections create / update / login
Not added to browser-pools create/update/acquire or browsers update: the
SDK carries the field there because the schema is shared, but the API
rejects export on pools and ignores it on a browser update, so a flag
there would be inert.
A destination requires capture to be enabled in the same request — the API
validates the payload on its own rather than consulting the stored config.
Create implies --telemetry=all (nothing to clobber); update and login
instead error with an actionable message, since enabling capture there
would replace the connection's current category selection.
Also surfaces export state in output: the browser create/update summary
(where the resolved destination is an ID string) and the auth connection
details table (where the stored request is echoed back as an {id, name}
object).
Full enumeration of all 127 api.md methods against the CLI command tree
found no missing commands.
Tested against the live API: browsers create --telemetry-export-otlp with
off / destination-by-name / destination-by-CUID; auth connections
create + get + update round-trip; both validation guards. Destination
lookup errors confirm the field reaches the server on each path (the test
org has no OTLP destinations configured, and no API exists to create one,
so a successful export bind could not be exercised end to end).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps github.com/kernel/kernel-go-sdk to
v0.86.1-0.20260806131931-10e64888bbba (commit 10e6488).
The upstream SDK commit only touched scripts/utils/upload-artifact.sh
(restoring a Stainless artifact download slug); no api.md entries, service
methods, or param structs changed.
Coverage analysis: full enumeration of all 130 SDK methods in api.md against
the 138-command CLI tree, plus a field-by-field comparison of every *Params
struct (including nested request bodies such as ManagedAuthCreateRequestParam,
CreateCredentialRequestParam, and UpdateProjectLimitsRequestParam) against the
flags of each command. No coverage gaps found. Endpoints marked x-cli-skip in
openapi.yaml (/auth/connections/{id}/exchange, audit-log export destinations)
are absent from the SDK and correctly absent from the CLI.
Tested: go vet ./... and go test ./... pass; smoke tested `kernel app list`
and `kernel browsers list` against the production API.
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to
v0.86.1-0.20260806134418-f64bbb81fe7c.
The upstream commit is a merge whose tree is identical to the previously
pinned 10e64888bbba, so there are no API surface changes: the generated
api.md and *.go sources are byte-identical between the two versions.
Coverage analysis performed anyway:
- Enumerated all 127 SDK methods from api.md (including nested resources:
Browsers.{Fs,Fs.Watch,Process,Computer,Telemetry,Replays,Logs,Playwright},
Auth.Connections, Organization.Limits).
- Enumerated all 138 CLI leaf commands and their flags.
- Expanded every *Params struct plus the nested request params
(ManagedAuthCreate/Update, CreateCredential, CreateCredentialProvider,
SubmitFields, UpdateOrgLimits, UpdateProjectLimits, CreateProject).
- No missing commands and no missing flags.
Verified the x-cli-skip endpoints (/auth/connections/{id}/exchange and the
/audit-logs/export/destinations family) are absent from the SDK surface, so
they need no CLI coverage.
Tested: go build ./..., go vet ./..., go test ./... all pass;
`kernel status` and `kernel profiles list` smoke-tested against the live API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.1-0.20260806134905-05231c859625. The SDK diff between the CLI's previous pin (v0.86.1-0.20260806134418-f64bbb81fe7c) and this commit is empty: the only SDK change is CI-only (.github/workflows/release-please.yml). No API surface changed. Coverage analysis: full enumeration of all 127 methods in api.md against the CLI command tree found no gaps. All 127 map to existing commands, and all 94 param structs' fields map to existing flags, positional args, or the --page/--per-page pagination pattern. Tested: go build ./..., go test ./... (all pass), and smoke tested `browsers list`, `profiles list`, `app list` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.1-0.20260806144011-2bc9fe850fb4. The SDK commit range 05231c85..2bc9fe85 contains no source changes (release/CI plumbing only), so there are no new methods or params. Coverage analysis: full enumeration of all 127 SDK methods in api.md against the CLI command tree found no gaps. Every method maps to a command, and every param struct field maps to a flag or positional argument (e.g. HoldKeys -> --hold-key, LastEventID -> --seq, AuditLogListParams.SearchUserID -> --user-id, BrowserCurlParams.TimeoutMs -> --max-time). The 7 x-cli-skip endpoints (auth connection exchange, audit-log export destinations) are absent from the SDK as expected. Tested: go build ./..., go test ./... (all pass), kernel app list against the production API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk from
v0.86.1-0.20260806144011-2bc9fe850fb4 to v0.86.1 (commit 4511ca3).
The SDK change between these two commits is release-only (CHANGELOG.md,
README.md, internal/version.go, .release-please-manifest.json). No API
surface changed, so there are no new commands or flags to add.
Coverage analysis: performed a full enumeration of all 127 SDK methods in
api.md and all 95 *Params structs against the existing CLI commands and
flags. No gaps found.
- All 127 SDK methods have CLI commands. The 7 streaming methods
(Auth.Connections.Follow, Browsers.Curl, Browsers.Logs.Stream,
Browsers.Process.StdoutStream, Browsers.Telemetry.Stream,
Deployments.Follow, Invocations.Follow) are covered via the SDK's
*Streaming variants or a raw HTTP client.
- All param fields are exposed as flags, positional args, or are
intentionally handled (pagination via --page/--per-page, audit-logs via
the SDK PageToken auto-pager, and curl via browsers.HTTPClient() for
streaming/binary-safe semantics where --max-time covers TimeoutMs).
- x-cli-skip endpoints (/auth/connections/{id}/exchange and the
/audit-logs/export/destinations family) are absent from the SDK.
Tested: go build ./..., go vet ./..., go test ./... (all pass); against
the live API: browsers list, profiles list, app list (verified pagination
footer and --page/--per-page on profiles and app), browsers create -t 30
-o json, browsers delete (cleaned up).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates kernel-go-sdk to b6de398f2ddc7a0620381ffa3c04a4d6d03f208f. Full enumeration of all 127 SDK methods in api.md and all 94 param structs against existing CLI commands and flags found no missing commands or flags. The only SDK change in this bump is a new response-only field, ProfileSaveChanges, on the browser session responses (BrowserNewResponse, BrowserGetResponse, BrowserUpdateResponse, BrowserListResponse, BrowserPoolAcquireResponse, InvocationListBrowsersResponseBrowser). The CLI already accepts this as input via --save-changes on `browsers create` and `browsers update`; this exposes the effective server-side value in the output: - buildBrowserTableData adds a "Profile Save Changes" row, shown only when a profile is attached (the API omits the field otherwise). This covers `browsers create`, `browsers get`, and `browser-pools acquire`. - `browsers update` echoes "Profile save changes: <bool>" when the command changed the profile, matching how it already echoes name and tags changes. Tested against the live API: - browsers create --profile-name X --save-changes -> row reads true - browsers create --profile-name X (no flag) -> row reads false - browsers create (no profile) -> row omitted - browsers get <id> -> row present - browsers get <id> -o json -> profile_save_changes present - browsers update <id> --profile-name X --save-changes -> echoes true - browser-pools acquire <pool> -> shared render path All test browsers, pools, and profiles were deleted afterward. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.2-0.20260807195052-6d7dc2e70cfe. Coverage analysis: a full enumeration of the 133 SDK methods in api.md against the CLI command tree found no gaps. The only new resource in this SDK bump is AuditLogs.ExportDestinations (New/Get/Update/List/ Delete/Test), and all six of its endpoints are marked x-cli-skip: true in openapi.yaml, so they are intentionally excluded from the CLI. No new commands or flags were added; smoke tested `kernel browsers list` against the live API and ran the full test suite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates github.com/kernel/kernel-go-sdk to d44daa947c65f1c5df1b68103e088bacb99fc455. The SDK added one new endpoint since the CLI's previous version (6d7dc2e): GET /auth/context, exposed as client.Auth.Context.Get. It is not marked x-cli-skip in the API spec, so it needs CLI coverage. New command: - `kernel auth context` - Show the identity and authorization context for the current credentials (principal, organization, credential scope, effective request scope). Supports `--output json`. A full enumeration of api.md methods against the CLI command tree found no other coverage gaps; no param structs changed in this SDK bump. Tested against the real API: - `kernel auth context` renders the table, with a null project_id in either scope shown as "organization-wide" - `kernel auth context --output json` prints the raw response - `kernel auth context --project <id>` reflects the project in the effective scope while the credential scope stays organization-wide - `go build ./...` and `go test ./...` pass Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bumps kernel-go-sdk to fd01c36a04c73192f29d4803e46bc2b6e004a9b9, which adds
region as a first-class API field on browser sessions and browser pools.
New flags:
- `browsers create --region us-east|eu-west` (BrowserNewParams.Region)
- `browsers list --region us-east|eu-west` (BrowserListParams.Region)
- `browser-pools create --region us-east|eu-west` (BrowserPoolNewParams.Region)
- `browser-pools list --region us-east|eu-west` (BrowserPoolListParams.Region)
Region is fixed at creation, so it is a create-only flag; there is no
corresponding update param. Values are validated client-side against the
API enum before the request is sent.
Region is also surfaced in output: a Region column in `browsers list`,
`browser-pools list`, and `invocations browsers`, and a Region row in
`browsers get` and `browser-pools get`.
A full enumeration of the 134 SDK methods in api.md against the CLI found no
missing commands; region was the only coverage gap.
Tested against the production API:
- browsers create --region us-east -> region echoed as us-east; browsers get
shows Region; browsers delete cleaned up
- browsers list --region us-east / --region eu-west -> filters correctly
- browser-pools create --region us-east and --region eu-west -> region echoed;
browser-pools get shows Region; browser-pools list --region filters; both
test pools deleted
- Invalid values (--region us-west, --region emea) rejected client-side
- Note: `browsers create --region eu-west` returns a server-side 500
("failed to create browser session"). The same region value succeeds for
pools, so this is eu-west session provisioning, not the CLI.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to 9f0076b20dc2f81709091497a89d587e996f75ee, which adds a
typed network configuration (network.private_hosts) to browser sessions and
browser pools.
New flags:
- `browsers create --private-host` (BrowserNewParams.Network.PrivateHosts)
- `browsers create --no-private-hosts`
- `browser-pools create --private-host` / `--no-private-hosts`
(BrowserPoolNewParams.Network.PrivateHosts)
- `browser-pools update --private-host` / `--no-private-hosts` /
`--clear-network` (BrowserPoolUpdateParams.Network)
The API gives three distinct meanings to the network field, so the CLI keeps
them distinguishable: omitting it keeps the default private ranges, an explicit
empty private_hosts list routes everything through Kernel-managed egress, and
(on pool update) an empty network object removes the configuration. The SDK's
omitzero encoder drops empty collections, so the empty cases go through
SetExtraFields, matching the existing --clear-extensions handling.
Entries are trimmed, blanks dropped, and the API's 32-entry cap is enforced
client-side. --private-host and --no-private-hosts are mutually exclusive, as
are --clear-network and either of them.
Private hosts are also surfaced in output: a Private Hosts row in
`browsers get` and `browser-pools get`, rendered as "-" when the defaults
apply and "none (all traffic uses Kernel-managed egress)" for an explicit
empty list.
Network is fixed at creation for a session (BrowserUpdateParams has no network
field), so there is no `browsers update` counterpart.
A full enumeration of the 134 SDK methods in api.md against the CLI command
tree found no missing commands; network.private_hosts was the only coverage gap.
Tested against the production API:
- browsers create --private-host '*.example.ts.net' --private-host
'100.64.0.0/10' -> echoed in the response and in browsers get; deleted
- browsers create --no-private-hosts -> network {"private_hosts": []}; get
renders "none (all traffic uses Kernel-managed egress)"; deleted
- browsers create with no flag -> no network in the response; get renders "-"
- browser-pools create --private-host / --no-private-hosts -> stored on
browser_pool_config.network; acquire propagates it to the leased session
- browser-pools update --private-host, --no-private-hosts, and --clear-network
-> ["preview.internal"], [], and removed, respectively; pools deleted
- Rejected client-side: --private-host with --no-private-hosts, --clear-network
with --private-host, and 33 private hosts
- Rejected server-side with a clear message: --private-host 8.8.8.0/24
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk from v0.88.1-0.20260812160430-9f0076b20dc2 to v0.89.0 (8cd3af2). The upstream change is release-only (version.go, CHANGELOG, README, release-please manifest) -- no api.md or *.go API surface changes -- so no new commands or flags were required. Coverage: full enumeration of all 134 SDK methods in api.md against the CLI command tree found no gaps. `client.Browsers.Curl` is covered by `kernel browsers curl`, which goes through the SDK's browser routing HTTP client (/curl/raw) rather than the JSON curl endpoint. Tested: go build ./..., go test ./... (all packages pass), `kernel browsers list` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates github.com/kernel/kernel-go-sdk to 79d4c5c4ab91.
The SDK change moves the project path parameter from `id` to `id_or_name`
(GET/PATCH/DELETE /org/projects/{id_or_name} and its /limits routes) and
adds `option.WithProject`, which sends the `X-Kernel-Project` header
accepting either a project ID or an exact project name.
Coverage analysis (full enumeration of api.md against the CLI command
tree) found no missing commands and no missing flags. All 130 SDK methods
map to existing commands; the apparent flag gaps are aliased or singular
forms already present (--extension, --tag, --hold-key, --bypass-host,
-d/--data, --max-time, -t/--timeout, --private-host).
Changes:
- Global --project now uses option.WithProject instead of
option.WithProjectID, so it accepts a project name as well as an ID.
KERNEL_PROJECT gains the same behavior. Help text and README updated.
- projects update/delete/limits get/limits set forward the identifier to
the API instead of listing projects to translate a name into an ID.
This drops up to a full pagination sweep per invocation. `projects get`
already passed through.
- Removed the now-dead resolveProjectArg/resolveProjectByName helpers.
The API resolves names case-insensitively, matching the old client-side
behavior, so this is not a behavior change.
- Replaced the resolver unit tests with a test asserting every project
subcommand forwards its identifier verbatim and issues no List call.
Tested against the live API (project created and deleted as cleanup):
- projects create / get <name> / update <name> --name / delete <name>
- projects limits set <name> --max-concurrent-sessions / limits get <name>
- --project <name>, --project <id>, and KERNEL_PROJECT=<name> with
browsers list and browsers create; the issued session JWT carries the
same projectId for all three, confirming the header scopes writes.
- --project <bogus> returns "Project not found or inactive" rather than a
client-side error.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to 6a142ab834fe, which preserves canonical managed auth input metadata. The bump alone did not build, because of a bad merge already on this branch: Merge 7578a12 brought main's #226 into a branch that already carried the bot's own private-host implementation (8206ac2), and the resolution kept both copies. The result did not compile: PrivateHosts was declared twice in three input structs, buildNetworkParam was called with two different signatures, and the network field was assigned twice per request. Resolved in favor of main's flag surface. #226 deliberately did not expose the empty-private-hosts control ("preserve the API's omitted and configured network semantics without exposing the niche empty-list control in the CLI"), so `--no-private-hosts` and `--clear-network` are dropped and `--clear-private-hosts` is the single way to restore the default private ranges on a pool. buildNetworkParam no longer needs to return extra fields, since the only empty case left goes through the existing extraFields path for clears. Kept from the bot's side, since neither conflicts with that decision: entry trimming, the client-side 32-entry cap, and the "Private Hosts" row in `browsers get` / `browser-pools get`. Tests were duplicated the same way. The colliding TestBrowserPoolsCreate_WithPrivateHosts is now one test per concern: main's covers the request shape, and the bot's is retitled TestBrowserPoolsCreate_PrivateHostNormalization to cover trimming, omission, and the cap. TestBrowsersCreate_WithPrivateHosts gained the same three assertions. The README lost its duplicate flag entries. go build ./... and go test ./... both pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SDK 6a142ab adds response fields that describe the canonical inputs a managed auth flow is waiting on: - ManagedAuthField.Hint - context shown near the field, including the masked destination a one-time code was sent to - ManagedAuthChoice.MfaType - semantic MFA method (sms, call, email, totp, push, password, passkey, switch, other) - ManagedAuthChoice.MaskedDestination - masked phone or email for an MFA choice - ManagedAuthChoice.DisplayText / Context - text captured for the choice These are response-only, so there is no new flag to add, but they are what makes `auth connections submit --field-value` and `--choice-id` usable: without them the CLI listed choice IDs with no way to tell which MFA option was which, and code fields with no indication of where the code was sent. `auth connections get` and `follow` now render them. Fields print as `id (Label) [type, ref=..., required, hint="..."]` and choices as `id (Label) [type, sms, to=+1 ... 1234]`. The two commands previously formatted these inline and differently - follow printed bare IDs - so both now share formatManagedAuthField/formatManagedAuthChoice. The SDK models the get and follow payloads as distinct but identical types, so each call site converts to a small shared struct first. display_text stands in as the label when the API did not derive one. Tested: `auth connections get` and `follow` against the live API for a connection in a terminal state (no regression in output, stream connects). The new metadata is only populated while a flow is awaiting input, and no connection in the org was mid-flow, so the rendering itself is covered by a unit test built from the SDK's documented shapes rather than a live capture. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk from v0.88.1-0.20260812233107-6a142ab834fe to v0.90.0. The SDK diff between these versions contains only release metadata (CHANGELOG.md, internal/version.go, README.md, release-please manifest) — no API surface changes, so no new commands or flags are required. Coverage analysis: full enumeration of all 134 methods in the SDK's api.md against the CLI command tree found no gaps. All 96 param types are referenced by the CLI. Four param fields are intentionally not exposed: - BrowserCurlParams.TimeoutMs / .ResponseEncoding — `browsers curl` drives the browser's HTTP client directly (--max-time) rather than the wrapped endpoint, so raw bytes stream through without encoding. - AuthConnectionLoginParams.BrowserTelemetry — deprecated alias for browser.telemetry, already covered by `--telemetry`. - AuditLogListParams.PageToken — handled internally by ListAutoPaging. Tested: go build ./..., go vet ./..., go test ./... all pass. Smoke tested against the production API: browsers list, profiles list, proxies list, and a browsers create -> get -> delete round trip. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to 1f70e735bad9 ("Require a name on credential
providers and backfill unnamed rows").
Repairs the merge of main into this branch: main's #226/#228 were a
subset re-implementation of region/private-host support already on this
branch, and the automatic resolution dropped --proxy-name, --proxy-mode
and --private-host from `browsers create`, dropped --private-host from
`browser-pools create`, dropped the client-side --region validation and
the list name/query filters, and duplicated the Region table column.
Restores this branch's superset implementation and ports main's genuinely
new region tests and README notes on top.
Coverage: a full enumeration of the 134 methods in the SDK's api.md
against the CLI command tree found every method already exposed (the
four x-cli-skip endpoints are absent from the SDK). A field-level sweep
of every *Params struct against all defined CLI flags found no
uncovered options.
The SDK change itself is a validation tightening: a provider name is
trimmed and the trimmed value must be non-empty. The CLI now trims
--name on `credential-providers create`/`update` and rejects a
whitespace-only value locally instead of round-tripping a 400. Since
every provider is now guaranteed to have a name, `credential-providers
list` gains a Name column and `get` gains a Name row (`create` already
showed it).
Tested against the live API:
- credential-providers list/get show the backfilled names
- credential-providers create --name " x " reaches token validation
(name accepted trimmed); --name " " and update --name " " are
rejected client-side
- browsers create --private-host (present in the session JWT),
--proxy-mode direct, --region us-east; --region emea rejected locally
- browser-pools create --region us-east --private-host round-trips
through get; browsers/browser-pools list --region us-east|eu-west
- go build ./... and go test ./... clean
Note: `browsers create --region eu-west` returns a server-side
Internal_error for the test org. The CLI forwards the value correctly
(us-east succeeds, eu-west list filtering works), so this looks like a
server-side provisioning issue rather than a CLI defect.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps the Go SDK to cb90eb77d34aaeb9302fb701a6a613d1f3ff51af, which exposes configurable browser memory. - Add --memory to `browsers create` for BrowserNewParams.Memory, accepting the 8GiB (default) and 16GiB sizes the API allows for headful, non-GPU sessions. Values are validated and normalized before the request is made. - Show the allocated Memory in `browsers get`, mirroring the new memory field on the browser session responses. Tested against the real API: - browsers create --memory 16GiB -> memory: 16GiB; browsers get shows 16GiB - browsers create --memory 16gib -> normalized to 16GiB - browsers create (no flag) -> 8GiB; --headless -> 1GiB - browsers create --memory 4GiB -> rejected locally before the request - browsers create --headless/--gpu with --memory -> API rejection surfaced - all created sessions deleted afterwards Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to v0.90.1-0.20260814180759-25f9b283b2ec, which adds the customer-facing OTLP destination CRUD API (client.Telemetry.Destinations). Adds `kernel telemetry destinations` covering all five new SDK methods: - create (--name, --endpoint, --description, --header NAME=VALUE) - get <id-or-name> - list (--page, --per-page, --name, --query) - update (--name, --endpoint, --description, --header, --remove-header) - delete <id-or-name> (-y) list uses the page/per-page UX with the +1 lookahead, matching `kernel profiles list`. Header edits on update are key by key; removals go through the SDK's extra-fields escape hatch because a JSON null cannot be expressed through the typed map[string]string field. Full enumeration of api.md against the CLI command tree found no other coverage gaps. Tested against production: telemetry destinations create (with --header), get (by ID and name, table and --output json), list (empty, --per-page pagination footer and Next hint, --name and --query filters), update (--header rotation, --remove-header, --name rename, --description "" clear, --endpoint), delete (by name, by ID, not-found, and the in-use 409 while a browser was exporting to it). Verified a browser created with --telemetry-export-otlp <name> resolves to the new destination's ID. All test resources cleaned up.
kernel-internal
Bot
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit ba1def5. Configure here.
Bumps github.com/kernel/kernel-go-sdk from the 25f9b28 pseudo-version to the tagged v0.91.0 release. The api.md diff between 25f9b28 and 9a6636d touches only internal/version.go, so the telemetry destinations commands added in the previous commit already cover every new SDK method; a full enumeration of api.md against the CLI command tree found no remaining gaps. Re-smoke-tested `kernel telemetry destinations` against production on the bumped SDK, since the bump is what those commands run on: create (--name, --endpoint, --description, --header), get (--output json), update (--header rotation and --remove-header), list (--per-page footer), delete. All test resources cleaned up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
sjmiller609
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the evergreen coverage branch, so the merge to main carries several SDK bumps and every CLI change built on them since the last merge — considerably more than the latest commit. Full inventory below.
SDK Updates
9a6636dis version-only; the preceding25f9b28added the customer-facing OTLP destination CRUD API,cb90eb7added browser memory requests,1f70e73added credential provider names, plus earlier bumps for list filters, proxy config, auth context, and audit-log formats)New command groups
kernel telemetry destinations—create,get,list,update,deletefor OTLP export destinations.create/updatetake--name,--endpoint,--description,--header NAME=VALUE;updateadds--remove-header NAME(key-by-key edits via the SDK extra-fields escape hatch, since removal needs a JSONnull);listuses the page-based UX (--page,--per-page,--name,--query);deleteprompts unless-y;list --output jsonreturns a{destinations, page, per_page, has_more}pagination envelope. Header values are returned redacted, so only header names render.kernel auth context— shows the principal, organization, credential scope, and effective scope resolved for the current credentials (table or-o json).New flags on existing commands
browsers create:--memory(8GiB/16GiB, validated locally),--proxy-name,--proxy-mode(direct/default),--telemetry-export-otlp <id-or-name|off>(implies--telemetry=allwhen unset)browsers update:--proxy-name,--proxy-mode;--clear-proxyand--disable-default-proxyredefined as aliases of the modesbrowsers telemetry events:--order asc|desc(desc rejects--since, use--until)auth connections create/update/login:--proxy-mode,--stealth,--telemetry-export-otlp;createdocuments plan-derived--health-check-intervalboundsauth connections list:--queryapi-keys list:--name,--query,--status active|deleted|all,--sort-by,--sort-direction;--include-deletedkept as a deprecated alias for--status allaudit-logs download:--format jsonl.gz|jsonl;--todefault now derived from the window and formatbrowser-pools list:--name,--query;browser-pools acquire:--start-urlcredential-providers list,credentials list,deploy history,invoke history:--queryextensions list:--name,--queryprofiles list:--nameprojects list:--name,--query; project commands select by ID or nameproxies list:--name,--query--projectnow accepts a project name as well as an IDOutput changes (affect existing invocations)
browsers list: column order changed — Region moved next to Created At; empty values render-. Anything parsing this table positionally will need updating.browsers get: newMemory,Proxy(resolved selection or egress mode, replacing the conditionalProxy IDrow), andPrivate Hostsrows;browsers create/getwith a profile showProfile Save Changesorg limits get: newMax Auth Connections,Auth Connections Used,Min Health Check Intervalrows (rendered only when the API returns them)credential-providers list: newNamecolumnauth connections get: newBrowser Proxy/Browser Stealthrows; login prompts show canonical field/choice metadataapi-keys list:Deleted Atcolumn appears only when the filter can return deleted keys (default output unchanged)projects delete: success message echoes the identifier you passed rather than the resolved IDAlso rewords several help/error strings that the help renderer's first-word title-casing mangled (
Exact-Match,Destination(S),--Order).Testing
go vet ./...+go test ./...pass; new unit tests for telemetry destinations, auth context, proxy selection, and list filters409delete guard and redacted headers),browsers create --memory 16GiB --telemetry-export-otlp, proxy flag validation and mutual exclusion,--order desc, all new list filters,--status/--include-deleted,audit-logs --format(verified gzip vs NDJSON on disk),--projectby name,browser-pools acquire --start-url, and the output diffs listed above. All test resources deleted afterwards.auth connections create/update/loginflags (verified via help output and unit tests only, to avoid mutating shared auth connections)Triggered by: kernel/kernel-go-sdk@9a6636d (v0.91.0)
Reviewer: @kernel-internal[bot]
Note
Medium Risk
Large CLI/API-facing change set with a breaking
browsers listtable layout and new proxy/telemetry/export semantics on session and auth flows; risk is mitigated by client-side validation and extensive tests but affects automation parsing tables.Overview
Updates the CLI on kernel-go-sdk v0.91.0 and expands surface area across browsers, managed auth, projects, and observability.
New commands:
kernel telemetry destinations(OTLP endpoint CRUD with redacted headers and in-use delete guards) andkernel auth context(principal, org, credential vs effective scope). Projects gainget,delete, andlimits get/set; global--projectaccepts name or ID.Browsers & pools:
--memory(8/16 GiB), unified proxy selection (--proxy-id/--proxy-name/--proxy-mode; legacy--clear-proxy/--disable-default-proxymap to modes), normalized--private-host(cap 32),--telemetry-export-otlp, pool acquire--start-url, and telemetry events--order. Auth connections move proxy/stealth/telemetry underbrowserconfig and show richer canonical field/choice metadata onget/follow.Lists & exports: API keys, audit logs (
--format jsonlvsjsonl.gz), and many list commands add--query/--name/--status(API keys). Breaking:browsers listcolumn order changes (Region beside Created At);browsers getadds Memory, Proxy, and Private Hosts rows.Reviewed by Cursor Bugbot for commit 40025e8. Bugbot is set up for automated code reviews on this repo. Configure here.