CLI: Update SDK to fd01c36a04c73192f29d4803e46bc2b6e004a9b9 and add new commands/flags - #215
Open
kernel-internal[bot] wants to merge 28 commits into
Open
CLI: Update SDK to fd01c36a04c73192f29d4803e46bc2b6e004a9b9 and add new commands/flags#215kernel-internal[bot] wants to merge 28 commits into
kernel-internal[bot] wants to merge 28 commits into
Conversation
Updates github.com/kernel/kernel-go-sdk to v0.86.0 (b5ea2f3dee2cbb2af9001e4558a28a807d31aeb3). A full enumeration of all 127 api.md methods against the CLI command tree found no missing commands. Enumerating every *Params field against every command's flags surfaced a set of filter/sort/pagination params the CLI never exposed; this closes those. New flags: - kernel api-keys list: --name, --query, --status, --include-deleted (deprecated alias for --status all), --sort-by, --sort-direction. Adds a Deleted At column when the filter can return deleted keys, matching `browsers list`. - kernel projects list: --page, --per-page, --name, --query. This command previously had no flags at all and always returned the API's default page. Uses the page-based pagination UX with a footer, as in `app list`. - kernel browser-pools list: --name, --query - kernel extensions list: --name, --query - kernel proxies list: --name, --query - kernel profiles list: --name - kernel auth connections list: --query - kernel credentials list: --query - kernel credential-providers list: --query - kernel deploy history: --query - kernel invoke history: --query - kernel browser-pools acquire: --start-url (BrowserPoolAcquireParams.StartURL) - kernel browsers telemetry events: --order asc|desc (BrowserTelemetryEventsParams.Order), rejecting `--order desc --since` locally since the endpoint 400s on that combination. SDK 0.86.0 changes: - ManagedAuthField.ReplaceExisting is now surfaced by `auth connections get` (as a `replace-existing` field marker) and `auth connections follow`, so it is visible before running `submit`. - ProjectLimits.MaxPooledSessions doc-only deprecation; no CLI change needed (the flag already exists and the API rejects it). Also forwards `browsers create --pool-id/--pool-name --start-url` through to the acquire call instead of warning and dropping it. start_url is a per-lease override on BrowserPoolAcquireParams, so it now sits alongside name/tag/telemetry/timeout in poolLeaseAllowedFlags. Tested against the live API: - api-keys list --status all --sort-by name --sort-direction asc (verified sort order and Deleted At population), --query, --include-deleted, and --sort-by/--sort-direction/--status validation errors - projects list --per-page 3 / --page 2 (footer + Next hint), --name, --query - --name and --query on proxies/extensions/browser-pools/profiles list - --query on credentials/credential-providers/auth connections list, deploy history, invoke history - browsers telemetry events --order desc (returned seq 22->18 vs asc 1->5) and the --order desc --since / --order bogus validation errors - browser-pools acquire --start-url and browsers create --pool-id --start-url (API echoed start_url on both) - go build, go vet, and go test ./... all pass Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Bump github.com/kernel/kernel-go-sdk to v0.86.1-0.20260804210355-b94cd585bac0 (commit b94cd58). The new SDK commit is byte-identical to v0.86.0 in module content -- the two upstream commits only touch CI promotion workflows, which are not part of the Go module. A full enumeration of all 127 SDK methods in api.md against the CLI command tree, and of all 95 *Params structs (345 fields, including nested unions) against every CLI flag, found no coverage gaps. Also fix the pagination footer hint in `kernel profiles list`, which suggested `kernel profile list` (singular, not a real command). Tested: go build ./..., go vet ./..., go test ./... (all pass); smoke-tested `kernel browsers list`, `kernel profiles list`, and `kernel profiles list --per-page 3` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Target SDK commit 9e39767e809b04f0786fb17377eb800fa624bddc contains no API
changes: it adds only .github/workflows/stlc-{promote,sync}.yml on top of
v0.86.0. `git diff v0.86.0..9e39767` touches zero .go files and no api.md.
The SHA is also not resolvable as a module version on its own -- it exists
only on the staging repo's main, so `go get 9e39767` fails with "unknown
revision". go.mod needs no change here: the preceding commit already moved it
to v0.86.1-0.20260804210355-b94cd585bac0, and b94cd58 is a direct child of
9e39767, so that pseudo-version already contains this target commit.
Coverage was re-enumerated from scratch anyway rather than trusting the
empty diff. All 127 methods in api.md map to an existing command; the seven
x-cli-skip endpoints in openapi.yaml (auth connections exchange, audit-log
export destinations) are absent from the SDK, so nothing to skip. Every
*Params field was diffed against every command's flags, including expanding
the embedded request structs (ManagedAuth*, CreateCredential*, CreateProject,
Update*Limits, CreateCredentialProvider*) and the ProxyNewParamsConfig union
variants, which the field-name comparison alone hides.
That surfaced one real gap, pre-existing rather than new in this bump:
- kernel audit-logs download: --format jsonl.gz|jsonl
(AuditLogExportChunkParams.Format). The format was hardcoded to jsonl.gz,
so uncompressed export was unreachable. The default output filename now
derives its extension from the format instead of always ending .jsonl.gz.
Two other unmatched fields were checked and are correctly not flags:
- BrowserCurlParams.ResponseEncoding: `browsers curl` does not call the SDK
Curl method at all. It streams raw bytes over the browser's HTTPClient,
which is already binary-safe, making the JSON-transport encoding moot.
- AuditLogListParams.PageToken / AuditLogExportChunkParams.Cursor: internal
pagination, driven by response headers.
Tested against the live API:
- audit-logs download --format jsonl (25-day window): 74 chunks, 3,669,435
rows, wrote audit-logs-20260710-20260804.jsonl; `file` reports NDJSON and
the lines parse as JSON.
- audit-logs download (default): wrote audit-logs-20260803-20260804.jsonl.gz;
gunzip yields 109,526 lines, matching the reported row count.
- audit-logs download --format jsonl.gz --to explicit.jsonl.gz: byte-identical
size to the default run.
- audit-logs download --format csv: rejected locally with
"invalid --format value: csv".
- go build ./... and go test ./... pass, before and after rebasing onto the
b94cd58 go.mod bump.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.1-0.20260805130902-f0262729f366 (commit f026272). The SDK diff between b94cd58 and f026272 is empty for api.md and all Go source files -- the only change in that range is a CI workflow file (.github/workflows/stlc-promote.yml). No new methods, no new param fields, so no CLI commands or flags were added. Coverage verification: - Enumerated all 127 SDK methods from api.md; every one has a corresponding CLI command. - Enumerated all 95 SDK *Params structs and their fields, diffed against all 205 CLI flags. Every remaining discrepancy resolved to a naming difference (--tag vs Tags, --kiosk vs KioskMode, --bypass-host vs BypassHosts, --env vs EnvVars), a positional argument, an embedded request-body struct, or a path parameter. - BrowserCurlParams.ResponseEncoding remains intentionally unexposed: `kernel browsers curl` bypasses the SDK Curl method and streams raw bytes through the browser's HTTP client, so response encoding does not apply. Tested: go build ./..., go vet ./..., go test ./... (all pass); smoke-tested `browsers list --limit 3` and `app list --per-page 2` against the live API -- both return expected output and the app list pagination footer renders correctly.
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to v0.86.1-0.20260805143436-f6072746e884 (kernel/kernel-go-sdk@f607274). The SDK diff between f026272 and f607274 contains no changes to api.md or any Go source file - f607274 is the stainless release merge commit and f026272 was a CI-only change. No new methods, params, or fields. Coverage analysis: performed a full enumeration anyway. All 126 SDK methods in api.md map to existing CLI commands, and every field of every *Params struct maps to an existing flag. The 7 endpoints marked x-cli-skip in openapi.yaml (auth connection exchange, audit-log export destinations) are absent from the SDK surface, as expected. One intentional non-gap: BrowserCurlParams.ResponseEncoding has no flag because `kernel browsers curl` bypasses the Browsers.Curl SDK method and streams raw bytes through the browser's HTTP client, so the base64 JSON transport option does not apply. Tested: go build ./..., go vet ./..., go test ./... (all pass), plus live API smoke tests of profiles list, browsers list, proxies list, api-keys list against the rebuilt binary. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to a42a4e3500ad02f7089f2903435d45ae907a1ff8.
The SDK adds telemetry.export.otlp (destination by id or name, plus an
enabled toggle) to every schema that embeds the shared telemetry request
config. Exposes it as --telemetry-export-otlp on the endpoints that
actually honor it:
- browsers create
- auth connections create / update / login
Not added to browser-pools create/update/acquire or browsers update: the
SDK carries the field there because the schema is shared, but the API
rejects export on pools and ignores it on a browser update, so a flag
there would be inert.
A destination requires capture to be enabled in the same request — the API
validates the payload on its own rather than consulting the stored config.
Create implies --telemetry=all (nothing to clobber); update and login
instead error with an actionable message, since enabling capture there
would replace the connection's current category selection.
Also surfaces export state in output: the browser create/update summary
(where the resolved destination is an ID string) and the auth connection
details table (where the stored request is echoed back as an {id, name}
object).
Full enumeration of all 127 api.md methods against the CLI command tree
found no missing commands.
Tested against the live API: browsers create --telemetry-export-otlp with
off / destination-by-name / destination-by-CUID; auth connections
create + get + update round-trip; both validation guards. Destination
lookup errors confirm the field reaches the server on each path (the test
org has no OTLP destinations configured, and no API exists to create one,
so a successful export bind could not be exercised end to end).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps github.com/kernel/kernel-go-sdk to
v0.86.1-0.20260806131931-10e64888bbba (commit 10e6488).
The upstream SDK commit only touched scripts/utils/upload-artifact.sh
(restoring a Stainless artifact download slug); no api.md entries, service
methods, or param structs changed.
Coverage analysis: full enumeration of all 130 SDK methods in api.md against
the 138-command CLI tree, plus a field-by-field comparison of every *Params
struct (including nested request bodies such as ManagedAuthCreateRequestParam,
CreateCredentialRequestParam, and UpdateProjectLimitsRequestParam) against the
flags of each command. No coverage gaps found. Endpoints marked x-cli-skip in
openapi.yaml (/auth/connections/{id}/exchange, audit-log export destinations)
are absent from the SDK and correctly absent from the CLI.
Tested: go vet ./... and go test ./... pass; smoke tested `kernel app list`
and `kernel browsers list` against the production API.
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to
v0.86.1-0.20260806134418-f64bbb81fe7c.
The upstream commit is a merge whose tree is identical to the previously
pinned 10e64888bbba, so there are no API surface changes: the generated
api.md and *.go sources are byte-identical between the two versions.
Coverage analysis performed anyway:
- Enumerated all 127 SDK methods from api.md (including nested resources:
Browsers.{Fs,Fs.Watch,Process,Computer,Telemetry,Replays,Logs,Playwright},
Auth.Connections, Organization.Limits).
- Enumerated all 138 CLI leaf commands and their flags.
- Expanded every *Params struct plus the nested request params
(ManagedAuthCreate/Update, CreateCredential, CreateCredentialProvider,
SubmitFields, UpdateOrgLimits, UpdateProjectLimits, CreateProject).
- No missing commands and no missing flags.
Verified the x-cli-skip endpoints (/auth/connections/{id}/exchange and the
/audit-logs/export/destinations family) are absent from the SDK surface, so
they need no CLI coverage.
Tested: go build ./..., go vet ./..., go test ./... all pass;
`kernel status` and `kernel profiles list` smoke-tested against the live API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.1-0.20260806134905-05231c859625. The SDK diff between the CLI's previous pin (v0.86.1-0.20260806134418-f64bbb81fe7c) and this commit is empty: the only SDK change is CI-only (.github/workflows/release-please.yml). No API surface changed. Coverage analysis: full enumeration of all 127 methods in api.md against the CLI command tree found no gaps. All 127 map to existing commands, and all 94 param structs' fields map to existing flags, positional args, or the --page/--per-page pagination pattern. Tested: go build ./..., go test ./... (all pass), and smoke tested `browsers list`, `profiles list`, `app list` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.1-0.20260806144011-2bc9fe850fb4. The SDK commit range 05231c85..2bc9fe85 contains no source changes (release/CI plumbing only), so there are no new methods or params. Coverage analysis: full enumeration of all 127 SDK methods in api.md against the CLI command tree found no gaps. Every method maps to a command, and every param struct field maps to a flag or positional argument (e.g. HoldKeys -> --hold-key, LastEventID -> --seq, AuditLogListParams.SearchUserID -> --user-id, BrowserCurlParams.TimeoutMs -> --max-time). The 7 x-cli-skip endpoints (auth connection exchange, audit-log export destinations) are absent from the SDK as expected. Tested: go build ./..., go test ./... (all pass), kernel app list against the production API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk from
v0.86.1-0.20260806144011-2bc9fe850fb4 to v0.86.1 (commit 4511ca3).
The SDK change between these two commits is release-only (CHANGELOG.md,
README.md, internal/version.go, .release-please-manifest.json). No API
surface changed, so there are no new commands or flags to add.
Coverage analysis: performed a full enumeration of all 127 SDK methods in
api.md and all 95 *Params structs against the existing CLI commands and
flags. No gaps found.
- All 127 SDK methods have CLI commands. The 7 streaming methods
(Auth.Connections.Follow, Browsers.Curl, Browsers.Logs.Stream,
Browsers.Process.StdoutStream, Browsers.Telemetry.Stream,
Deployments.Follow, Invocations.Follow) are covered via the SDK's
*Streaming variants or a raw HTTP client.
- All param fields are exposed as flags, positional args, or are
intentionally handled (pagination via --page/--per-page, audit-logs via
the SDK PageToken auto-pager, and curl via browsers.HTTPClient() for
streaming/binary-safe semantics where --max-time covers TimeoutMs).
- x-cli-skip endpoints (/auth/connections/{id}/exchange and the
/audit-logs/export/destinations family) are absent from the SDK.
Tested: go build ./..., go vet ./..., go test ./... (all pass); against
the live API: browsers list, profiles list, app list (verified pagination
footer and --page/--per-page on profiles and app), browsers create -t 30
-o json, browsers delete (cleaned up).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates kernel-go-sdk to b6de398f2ddc7a0620381ffa3c04a4d6d03f208f. Full enumeration of all 127 SDK methods in api.md and all 94 param structs against existing CLI commands and flags found no missing commands or flags. The only SDK change in this bump is a new response-only field, ProfileSaveChanges, on the browser session responses (BrowserNewResponse, BrowserGetResponse, BrowserUpdateResponse, BrowserListResponse, BrowserPoolAcquireResponse, InvocationListBrowsersResponseBrowser). The CLI already accepts this as input via --save-changes on `browsers create` and `browsers update`; this exposes the effective server-side value in the output: - buildBrowserTableData adds a "Profile Save Changes" row, shown only when a profile is attached (the API omits the field otherwise). This covers `browsers create`, `browsers get`, and `browser-pools acquire`. - `browsers update` echoes "Profile save changes: <bool>" when the command changed the profile, matching how it already echoes name and tags changes. Tested against the live API: - browsers create --profile-name X --save-changes -> row reads true - browsers create --profile-name X (no flag) -> row reads false - browsers create (no profile) -> row omitted - browsers get <id> -> row present - browsers get <id> -o json -> profile_save_changes present - browsers update <id> --profile-name X --save-changes -> echoes true - browser-pools acquire <pool> -> shared render path All test browsers, pools, and profiles were deleted afterward. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.2-0.20260807195052-6d7dc2e70cfe. Coverage analysis: a full enumeration of the 133 SDK methods in api.md against the CLI command tree found no gaps. The only new resource in this SDK bump is AuditLogs.ExportDestinations (New/Get/Update/List/ Delete/Test), and all six of its endpoints are marked x-cli-skip: true in openapi.yaml, so they are intentionally excluded from the CLI. No new commands or flags were added; smoke tested `kernel browsers list` against the live API and ran the full test suite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3f4bd30. Configure here.
Updates github.com/kernel/kernel-go-sdk to d44daa947c65f1c5df1b68103e088bacb99fc455. The SDK added one new endpoint since the CLI's previous version (6d7dc2e): GET /auth/context, exposed as client.Auth.Context.Get. It is not marked x-cli-skip in the API spec, so it needs CLI coverage. New command: - `kernel auth context` - Show the identity and authorization context for the current credentials (principal, organization, credential scope, effective request scope). Supports `--output json`. A full enumeration of api.md methods against the CLI command tree found no other coverage gaps; no param structs changed in this SDK bump. Tested against the real API: - `kernel auth context` renders the table, with a null project_id in either scope shown as "organization-wide" - `kernel auth context --output json` prints the raw response - `kernel auth context --project <id>` reflects the project in the effective scope while the credential scope stays organization-wide - `go build ./...` and `go test ./...` pass Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.86.2-0.20260808025144-654fc1c964ba (654fc1c). 654fc1c is a merge commit of d44daa9, which the CLI was already pinned to, so there are no SDK source changes in this bump. Coverage analysis: full enumeration of all 134 methods in the SDK's api.md against every CLI command and flag found no gaps. The six client.AuditLogs.ExportDestinations.* methods remain intentionally uncovered - all of their endpoints are marked x-cli-skip: true in openapi.yaml. Tested: go build ./..., go vet ./..., go test ./... all pass; kernel auth context and kernel app list verified against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk from v0.86.2-0.20260808025144-654fc1c964ba to v0.87.0 (3d0249f678cda7ea4f415a0fb9f4fcd6055e7183). The SDK diff between these revisions contains no API changes -- only the release-please version bump (CHANGELOG, README, internal/version.go). Coverage analysis: performed a full enumeration of all 134 SDK methods in api.md against the full CLI command tree (139 leaf commands), plus an automated sweep of every *Params struct field against every CLI flag. All non-x-cli-skip SDK methods have CLI commands and all param fields have flags. No gaps found. Tested: go build ./..., go vet ./..., go test ./... all pass; smoke tested `kernel browsers list` and `kernel profiles list` against the real API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
kernel-internal
Bot
changed the title
Updates github.com/kernel/kernel-go-sdk to v0.87.1-0.20260808195625-4e924dfdce39 (4e924df). The SDK moved browser proxy selection from the now-deprecated `proxy_id` / `disable_default_proxy` fields to a `proxy` object taking exactly one of id, name, or mode, and gave managed auth connections a `browser` config object carrying proxy, stealth, and telemetry. New flags: - `browsers create` / `browsers update`: --proxy-name, --proxy-mode (direct|default). --proxy-id now populates proxy.id; --clear-proxy and --disable-default-proxy are folded into the equivalent mode change. - `auth connections create` / `update` / `login`: --proxy-mode, --stealth. Proxy and telemetry now go through the connection's browser config. `browsers get` reports the resolved proxy, and the auth connection tables report the connection's browser proxy, stealth, and telemetry. Tested against the real API: browsers create --proxy-mode direct/default, --proxy-name, --proxy-id; browsers update --proxy-mode, --proxy-id, --proxy-name, --clear-proxy, --disable-default-proxy; browsers get proxy row; auth connections create/update/login --proxy-mode --proxy-name --stealth --telemetry; conflicting-flag and unknown-mode validation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bump github.com/kernel/kernel-go-sdk to v0.87.1-0.20260809163238-cd3e117dbbb8 (cd3e117). SDK change: adds the `requires_customer_input` value to ManagedAuthCanReauthReason. The CLI renders CanReauthReason as a raw string (cmd/auth_connections.go) rather than switching on the enum, so the new value surfaces with no code change. Coverage analysis: full enumeration of all 134 methods in api.md against the CLI command tree found no gaps. The 6 audit-logs export-destination methods are marked x-cli-skip in openapi.yaml. Telemetry.Stream, Process.StdoutStream, and Logs.Stream are covered via their *Streaming variants. Param-field sweep across all 98 *Params structs found no missing flags. Tested: go build ./..., go vet ./..., go test ./... (all pass); `kernel auth connections list --limit 3` and `kernel browsers list --limit 3` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bump github.com/kernel/kernel-go-sdk to v0.87.1-0.20260810163328-5819723ab49d (5819723). The merge of main into this branch had reset go.mod to v0.87.0, so this diff spans v0.87.0. SDK changes in range: - New BrowserProxyConfigParam / BrowserProxyMode on BrowserNewParams and BrowserUpdateParams, plus BrowserProxy / BrowserProxyConfig responses. Already covered by --proxy-id/--proxy-name/--proxy-mode on `browsers create` and `browsers update`. - New ManagedAuthBrowserConfigParam (stealth, proxy, telemetry) on auth connection create, update, and login. Already covered by --stealth, --proxy-*, --telemetry, and --telemetry-export-otlp. - HealthCheckInterval docs now document a Free-plan minimum of 21600 (6h) and a default of 3600 or the plan minimum, whichever is larger. Changes: - Fix a build break inherited from the main merge: cmd/projects.go imported samber/lo but main's header-based pagination rewrite no longer uses it, so `go build ./...` failed on the branch tip. - Reword --health-check-interval help on `auth connections create` and `update` to match the new SDK docs (plan minimums incl. Free 21600, and the max(3600, plan minimum) default). Coverage analysis: full enumeration of all 134 methods in api.md against the CLI command tree found no missing commands. Param-field sweep across all 111 *Params/*RequestParam structs found no missing flags. Investigated and deliberately not added: the SDK exposes Telemetry.Export.Otlp on BrowserUpdateParams and on all three BrowserPool*Params, because every telemetry field is generated from one shared BrowserTelemetryRequestConfig schema. The API does not honor it there -- openapi.yaml states pools reject export and browser update ignores it, and a live `browser-pools create --telemetry-export-otlp` probe returned "telemetry.export is only supported when creating a browser". Export stays on `browsers create` and the managed-auth commands only, as README already documents. Note for reviewers: the 6 audit-logs export-destination endpoints are still marked x-cli-skip in openapi.yaml but were implemented on main in #214, so `kernel audit-logs export *` now covers them. Left as-is; the annotation looks stale. Tested: go build ./..., go vet ./..., go test ./... (all pass). Against the live API: `projects list` (the file with the build fix), `auth connections list`, `browsers list`, and a full proxy-config round trip -- `browsers create --proxy-mode direct --stealth` returned proxy.mode=direct, `browsers update --proxy-mode default` then `browsers get` returned proxy.mode=default, `browsers delete` cleaned up. Verified the reworded --health-check-interval help renders. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Contributor
Author
Automated SDK bump skipped:
|
Removed on main |
CLI code that depends on it |
|---|---|
BrowserProxyConfig / BrowserProxyConfigParam / BrowserProxyMode / BrowserProxy |
cmd/browser_proxy.go, cmd/browsers.go (--proxy-id/--proxy-name/--proxy-mode, --clear-proxy) |
ManagedAuthBrowserConfig* (incl. ...TelemetryExport) |
cmd/auth_connections.go, cmd/browsers_telemetry.go |
BrowserPoolRef.Proxy, Invocation*.Proxy |
browser pool / invocation output |
Building against ae64a74 fails:
cmd/browser_proxy.go:15:16: undefined: kernel.BrowserProxyModeDirect
cmd/auth_connections.go:286:40: undefined: kernel.ManagedAuthBrowserConfig
cmd/browsers_telemetry.go:253:44: undefined: kernel.ManagedAuthBrowserConfigTelemetry
... (and more)
Applying the bump would mean deleting shipped, working flags. It's the SDK's main that is lagging, not the CLI getting ahead of the API:
kernel-apipackages/api/openapi.yaml(main) defines bothBrowserProxyConfigandManagedAuthBrowserConfig.- Verified against production —
kernel browsers create --proxy-mode directreturns"proxy": {"mode": "direct"}.
The pin stays at 5819723ab49d until stainless/release merges into SDK main; the next trigger from main will then bump cleanly.
Coverage analysis (performed anyway)
Full enumeration of api.md against the CLI command tree:
- 134 SDK methods, 134 covered. No missing commands.
- Method sets are byte-identical between
5819723andae64a74— the only delta is param/response fields, all removals. - Field-vs-flag sweep across every
*Paramsstruct surfaced no real gaps. (BrowserCurlParams.response_encodinghas no flag by design —kernel browsers curlstreams raw bytes through the browser HTTP client instead of using the typed curl params.) go build ./...andgo test ./cmd/...pass on the current pin.
Triggered by: kernel/kernel-go-sdk@ae64a74
Reviewer: @rgarcia
Bumps github.com/kernel/kernel-go-sdk from
v0.87.1-0.20260810163328-5819723ab49d (5819723) to
v0.87.1-0.20260810193033-d21e6b3a3411 (d21e6b3, tip of
kernel-go-sdk's stainless/release).
Why not d2577f5, the commit that triggered this update
----------------------------------------------------
d2577f5 is the tip of kernel-go-sdk's main. Relative to the SDK version
this branch already used, moving to it is a pure *downgrade*:
git diff 5819723..d2577f5 -> 5 files, 144 insertions, 690 deletions
git diff 5819723..d21e6b3 -> 1 test file, 67 insertions, 0 deletions
The proxy-configuration and managed-auth browser-config generation lives
on stainless/release and has not been merged into main yet. 5819723 is
reachable only from origin/stainless/release; main's merge-base with it
is ae64a74. So main is missing these SDK types:
BrowserProxy, BrowserProxyConfig, BrowserProxyConfigParam,
BrowserProxyMode, BrowserNewParams.Proxy, BrowserUpdateParams.Proxy,
the .Proxy field on the browser/pool/invocation responses,
ManagedAuthBrowserConfig(Param) and its telemetry sub-structs,
ManagedAuth{Create,Update}RequestParam.Browser,
AuthConnectionLoginParams.Browser, and
ManagedAuthCanReauthReasonRequiresCustomerInput.
Pinning to d2577f5 does not compile -- 11 errors across
cmd/browser_proxy.go, cmd/browsers.go, cmd/auth_connections.go, and
cmd/browsers_telemetry.go -- and the only way to make it compile is to
delete the proxy-config CLI surface added in 87b04e8: --proxy-name,
--proxy-mode, --clear-proxy handling on `browsers create`/`update`, the
resolved-proxy row in `browsers get`, and the --proxy-*/--stealth flags
on `auth connections create`/`update`/`login`.
That surface is not dead code. packages/api/openapi.yaml still defines
BrowserProxyConfig (line 2005) and ManagedAuthBrowserConfig (line 3936),
and the feature works against production right now:
browsers create --proxy-mode direct --stealth -> get shows Proxy: direct
browsers update <id> --proxy-mode default -> accepted
browsers delete <id> -> cleaned up
So the SDK's Go types lag the deployed API; the API itself has not
regressed. Deleting working, API-supported commands to match a
generation gap that stainless/release will close on its next merge to
main would be a user-facing regression plus immediate re-add churn.
d21e6b3 is a strict superset of 5819723 -- it keeps every feature, picks
up main's history through ae64a74, and compiles.
d2577f5 itself contributes nothing to the CLI: its only non-merge commit,
d8607d7, touches browser_routing_test.go alone.
Note: /tmp/sdk-diff.patch supplied to this run was empty, which would
suggest a no-op version bump. It is wrong -- api.md and 4 source files do
differ between the two versions. The real diff was regenerated from the
module cache.
Coverage analysis
-----------------
Full enumeration of all 134 methods in api.md against the CLI: every one
has a call site. The three with no plain `.Stream(` caller --
Browsers.Logs.Stream, Browsers.Telemetry.Stream,
Browsers.Process.StdoutStream -- correctly use the SSE `*Streaming`
variants (cmd/browsers.go:942, cmd/browsers_telemetry.go:378,
cmd/browsers.go:1840). No missing commands.
Param sweep over all 377 json fields across every *Params/*RequestParam
struct found no missing flags. Four names had no literal match and were
each checked by hand:
- SubmitFieldsRequestParam.selected_choice_id -> `--choice-id`
(SelectedChoiceID; the sweep missed the ID-vs-Id casing).
- BrowserComputerBatchParamsAction.sleep -> passes through
`browsers computer batch --actions` raw JSON.
- BrowserCurlParams.timeout_ms / response_encoding -> `browsers curl` is
deliberately not built on client.Browsers.Curl. It requests through
the browser's routed http.Client (cmd/browsers.go:3860) to get real
curl semantics: byte-exact binary-safe output, -o, -D, -w, -f. That
makes response_encoding moot and maps timeout_ms to a client-side
--max-time. Left as-is.
No new commands or flags were required by this update.
Tested: go build ./..., go vet ./..., go test ./... all pass. Against
production: browsers list, auth connections list, proxies list, and the
proxy-config round trip above.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bump github.com/kernel/kernel-go-sdk to v0.87.1-0.20260810195755-5882994b59e0 (commit 5882994). The api.md/Go source diff between the CLI's previous SDK pin (d21e6b3) and 5882994 is empty, so there are no new SDK methods or param fields to cover. A full enumeration of all 134 endpoints in api.md against the CLI command tree confirmed every method has a command (AuditLogs.ExportDestinations.* are x-cli-skip but covered anyway via `kernel audit-logs export`). The flag-level enumeration did surface one pre-existing gap: ProjectListParams.Name and ProjectListParams.Query had no flags on `kernel projects list`. Added --name (exact match) and --query (substring search); the truncation hint now preserves both filters. Tested against the real API: - kernel projects list --name behroz (exact match, 1 row) - kernel projects list --query behroz (substring, 2 rows) - kernel projects list --query claude -o json (JSON output) - kernel projects list --query e --limit 2 (hint keeps --query "e") - kernel browsers create/get/delete round trip on the new SDK - go build ./... && go vet ./... && go test ./... all pass Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk from v0.87.1-0.20260810195755-5882994b59e0 to v0.88.0. This SDK release contains no API surface changes -- the diff between the two versions touches only CHANGELOG.md, README.md, the release-please manifest, and internal/version.go (0.87.0 -> 0.88.0). api.md is byte identical, so there are no new methods, params, or fields to expose. Coverage analysis: full enumeration of all 134 SDK methods in api.md against all 147 CLI leaf commands found no missing commands, and a field-level sweep of all 98 *Params structs (327 fields) against CLI flags found no missing flags. Tested: go build ./..., go vet ./..., go test ./... (all pass); browsers list, profiles list, app list, and a full browsers create -> get -> delete round trip against the live API.
kernel-internal
Bot
changed the title
Bump github.com/kernel/kernel-go-sdk to
v0.88.1-0.20260810220556-1b7bde817875 (commit 1b7bde8).
/tmp/sdk-diff.patch is empty, and `git diff 7e9d5f1..1b7bde8` in the SDK
repo touches only .github/workflows/release-please.yml,
.github/workflows/stlc-promote.yml and release-please-config.json. No
api.md, param struct, or generated client changes, so there are no new
SDK methods or param fields to cover.
Full enumeration performed anyway:
- Method coverage: all 134 methods in api.md map to a CLI command
(134/134). post /auth/connections/{id}/exchange is x-cli-skip and is
absent from the SDK; AuditLogs.ExportDestinations.* are x-cli-skip but
remain covered via `kernel audit-logs export`.
- Flag coverage: extracted the fields of all 97 param structs referenced
by api.md (including nested Profile/Proxy/Telemetry/Viewport and the
ProxyNewParamsConfig union variants) and matched each against the flag
set of every CLI leaf command. No gaps. Fields that look unmatched by
name are positional args (Playwright Code, ExtensionDownloadFromChromeStore
URL, DeploymentList AppName), renamed flags (AcquireTimeoutSeconds ->
--timeout, LastEventID -> --seq, SearchUserID -> --user-id,
Viewport.RefreshRate -> --viewport WxH@RR), or internal pagination
(AuditLogList PageToken, AuditLogExportChunk Cursor).
- BrowserCurlParams.ResponseEncoding stays unexposed by design: `kernel
browsers curl` streams raw bytes through the browser's HTTP client
rather than the JSON /curl endpoint, so there is no encoding to pick.
Tested: go build ./..., go vet ./..., go test ./... (all packages pass),
plus live API smoke tests against the new SDK: `browsers list`,
`profiles list`, `app list` (pagination footers correct), and a
`browsers create -t 30` -> `browsers get` (timeout_seconds=30) ->
`browsers delete` round trip.
kernel-internal
Bot
changed the title
Updates github.com/kernel/kernel-go-sdk to v0.88.1-0.20260811234930-25ccf2ec8b8b. The SDK change adds three plan-derived fields to the GET /org/limits response (OrgLimits): max_auth_connections, auth_connections_used, and min_health_check_interval_seconds. `kernel org limits get` now renders them. Rows are keyed on field presence rather than validity so a null max_auth_connections still renders as "unlimited", while older API versions that omit the fields entirely keep the previous output. Full enumeration of api.md against cmd/ found no other coverage gaps: every SDK method has a CLI command, and no new params were added. Tested: kernel org limits get (table + --output json) against the live API; go build ./..., go vet ./..., go test ./... all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to fd01c36a04c73192f29d4803e46bc2b6e004a9b9, which adds
region as a first-class API field on browser sessions and browser pools.
New flags:
- `browsers create --region us-east|eu-west` (BrowserNewParams.Region)
- `browsers list --region us-east|eu-west` (BrowserListParams.Region)
- `browser-pools create --region us-east|eu-west` (BrowserPoolNewParams.Region)
- `browser-pools list --region us-east|eu-west` (BrowserPoolListParams.Region)
Region is fixed at creation, so it is a create-only flag; there is no
corresponding update param. Values are validated client-side against the
API enum before the request is sent.
Region is also surfaced in output: a Region column in `browsers list`,
`browser-pools list`, and `invocations browsers`, and a Region row in
`browsers get` and `browser-pools get`.
A full enumeration of the 134 SDK methods in api.md against the CLI found no
missing commands; region was the only coverage gap.
Tested against the production API:
- browsers create --region us-east -> region echoed as us-east; browsers get
shows Region; browsers delete cleaned up
- browsers list --region us-east / --region eu-west -> filters correctly
- browser-pools create --region us-east and --region eu-west -> region echoed;
browser-pools get shows Region; browser-pools list --region filters; both
test pools deleted
- Invalid values (--region us-west, --region emea) rejected client-side
- Note: `browsers create --region eu-west` returns a server-side 500
("failed to create browser session"). The same region value succeeds for
pools, so this is eu-west session provisioning, not the CLI.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates the Go SDK to fd01c36a04c73192f29d4803e46bc2b6e004a9b9 and adds CLI commands/flags for new SDK methods.
SDK Update
fd01c36a04c73192f29d4803e46bc2b6e004a9b9(v0.88.1-0.20260812012808-fd01c36a04c7)Coverage Analysis
This PR was generated by performing a full enumeration of SDK methods and CLI commands. All 134 methods listed in
api.mdhave a corresponding CLI command (the onlyx-cli-skipendpoint,POST /auth/connections/{id}/exchange, remains excluded). The SDK diff added no new methods;regionwas the only new request param, on browser and browser-pool create/list.New Commands
None — no new SDK methods.
New Flags
--regiononkernel browsers createforBrowserNewParams.Region--regiononkernel browsers listforBrowserListParams.Region--regiononkernel browser-pools createforBrowserPoolNewParams.Region--regiononkernel browser-pools listforBrowserPoolListParams.RegionAccepted values are
us-eastandeu-west, validated client-side against the API enum before the request is sent. Region is fixed at creation, so it is create-only — the update params have no region field, andbrowser-pools updateintentionally does not get the flag. Onbrowsers create,--regionis not in the pool-lease allowlist, so pairing it with--pool-id/--pool-namesurfaces the usual "pool determines configuration" conflict warning.Other Changes
Region is surfaced in output now that it is a first-class field:
Regioncolumn inkernel browsers list,kernel browser-pools list, andkernel invocations browsersRegionrow inkernel browsers getandkernel browser-pools getREADME flag documentation updated for all four commands, including a note that
browser-pools updatedoes not accept--region.This branch also carries the earlier
org limits getwork from the 25ccf2e SDK bump (plan-derived auth limits).Testing
Ran against the production API:
All test resources were deleted afterwards (one browser session, two pools).
Note:
kernel browsers create --region eu-westreturns a server-side 500 (Internal_error: failed to create browser session), reproducibly. The identical region value succeeds for pools and for the list filter, so the flag reaches the API correctly — this looks like eu-west browser session provisioning, not a CLI issue.Added unit tests covering flag forwarding, the unset default, and rejection of unknown regions for both resources.
go build ./...,go vet ./..., andgo test ./...all pass.Triggered by: kernel/kernel-go-sdk@fd01c36
Reviewer: @kernel-internal[bot]
Note
Medium Risk
Touches proxy egress and auth-connection browser config across a large CLI surface, but mostly wires existing SDK fields rather than changing server-side auth or security logic.
Overview
Surfaces a broad set of SDK capabilities in the CLI: geographic regions, a unified proxy selection model, OTLP telemetry export, a new auth context command, and richer list/search filters.
Browsers & pools. Adds
--region us-east|eu-weston create and list (fixed at creation; Start-Up/Enterprise). Replaces the old proxy-id-only path with mutually exclusive--proxy-id/--proxy-name/--proxy-mode(direct|default); legacy--clear-proxyand--disable-default-proxymap onto those modes. Pool acquire (andbrowsers create --pool-*) can override--start-urlper lease.Telemetry. Adds
--telemetry-export-otlp <id-or-name>on browser create and auth-connection create/update/login (implies capture on create; update/login require an explicit--telemetry). Export is creation-bound for sessions; pools do not support it. Telemetry events gain--order asc|desc.Auth. New
kernel auth contextshows principal, org, credential scope, and effective scope. Auth connections move proxy/stealth/telemetry under a nested browser config and gain the same proxy-mode and stealth flags.List/search & misc. Adds
--query/--name(and related) filters across API keys, auth connections, pools, credentials, providers, deployments, invocations, extensions, profiles, and projects. API keys list gains--status,--sort-by, and--sort-direction. Audit log download accepts--format jsonl.gz|jsonl.org limits getrenders plan-derived managed-auth limits when present.Reviewed by Cursor Bugbot for commit 872a66d. Bugbot is set up for automated code reviews on this repo. Configure here.