CLI: Update SDK to 8abbe5e87d792f63c11f20c9c3ebe8046457ad4a and add new commands/flags by kernel-internal[bot] · Pull Request #231 · kernel/cli

kernel-internal · 2026-08-17T20:48:00Z

This PR updates the Go SDK to 8abbe5e87d792f63c11f20c9c3ebe8046457ad4a and adds CLI coverage for the new SDK fields.

SDK Update

Updated kernel-go-sdk to 8abbe5e87d792f63c11f20c9c3ebe8046457ad4a (v0.100.1-0.20260905202137-8abbe5e87d79)

Coverage Analysis

This PR was generated by performing a full enumeration of SDK methods and CLI commands. The api.md enumeration produced 158 method entries; the CLI command tree has 168 leaf commands. Every SDK method has a CLI command, except the five config-registry endpoints and /auth/connections/{id}/exchange, which are marked x-cli-skip: true in openapi.yaml.

The SDK diff since the previous version adds no new methods and no new request params — only three response fields (OrgLimits.max_vaults, OrgLimits.vaults_used, OrgEntitlementsLimits.max_vaults) plus updated method docs for the free-plan vault cap. So there are no new commands or flags; the gap was output coverage in the commands that already render those payloads.

New Output Coverage

kernel org limits get — added Max Vaults and Vaults Used rows for OrgLimits.MaxVaults / OrgLimits.VaultsUsed. Both are guarded on field presence like the existing managed auth rows, and a null max_vaults (paid plans and active trials) renders as unlimited.
kernel org entitlements — added a Max vaults limit row for OrgEntitlementsLimits.MaxVaults, also unlimited-aware.

Help Text

kernel vaults create — added a Long description carrying the new VaultService.Upsert comment: free orgs cap at 3 non-deleted vaults across all projects, paid plans and active trials are uncapped, and retrieving an existing vault by name still succeeds at the limit.
kernel org limits get — help now mentions vault limits and usage, matching the updated OrganizationLimitService.Get comment.

Testing

Tested against the live API:

kernel org limits get — table and --output json both show Max Vaults: unlimited and Vaults Used: 7
kernel org entitlements — Max vaults row renders as unlimited; JSON limits.max_vaults is null
kernel vaults create --name ... → kernel vaults delete ... --yes round trip moved vaults_used 7 → 8 → 7, confirming the new counter tracks correctly

go build ./..., go vet ./..., and go test ./... all pass. Unit tests added for the new rows (present, null/unlimited, and omitted-when-absent cases).

Triggered by: kernel/kernel-go-sdk@8abbe5e
Reviewer: @kernel-internal[bot]

Bump github.com/kernel/kernel-go-sdk to v0.91.1-0.20260817203807-0a287359dcc5 (0a28735). Coverage gap found by enumerating all 140 methods in the SDK's api.md against the CLI command tree: the new Organization.Entitlements resource had no CLI surface. Everything else was already covered. New command: - `kernel org entitlements get` for client.Organization.Entitlements.Get (GET /org/entitlements). Renders Plan, Features, and Limits sections; supports --output json. Null constraint values mean unlimited in this API, and the SDK models them as non-pointer int64, so rendering keys off respjson field validity rather than the zero value. Tested against the real API: - kernel org entitlements get (table output, ENTERPRISE plan) - kernel org entitlements get --output json - kernel org entitlements get --output yaml (rejected as expected) - go build ./... and go test ./... pass, including 5 new unit tests covering populated constraints, null-as-unlimited, null plan fields, invalid --output, and API errors. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

socket-security · 2026-08-17T20:48:45Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/kernel/kernel-go-sdk@v0.100.0 ⏵ v0.100.1-0.20260905202137-8abbe5e87d79	⁺¹

View full report

Updates github.com/kernel/kernel-go-sdk from v0.91.1-0.20260817203807-0a287359dcc5 to v0.92.0. ## Coverage Analysis Diffing the two module sources shows the SDK API surface is byte-identical between these versions -- the only changes are release metadata (.release-please-manifest.json, CHANGELOG.md, README.md, internal/version.go). A full enumeration was still performed: - All 140 SDK methods in api.md have corresponding CLI commands. - The 4 x-cli-skip endpoints (/site-configs/lookup, /site-configs/resolve, /site-configs/analyses/{id}, /auth/connections/{id}/exchange) are absent from the SDK surface, so nothing to skip. - All params struct fields are covered by CLI flags except three, each intentional: - AuthConnectionLoginParams.BrowserTelemetry -- deprecated in favor of browser.telemetry, which the CLI already uses via ManagedAuthBrowserConfigParam. - AuditLogListParams.PageToken -- opaque cursor handled internally by ListAutoPaging; CLI exposes --limit instead. - BrowserCurlParams.TimeoutMs / ResponseEncoding -- `browsers curl` is implemented against browsers.HTTPClient rather than the SDK curl endpoint; --max-time covers the timeout and raw bytes are streamed, so response encoding is not applicable. No coverage gaps found; no new commands or flags added. ## Tested - go build ./... and go vet ./... clean - go test ./... all packages pass - Smoke tested rebuilt binary against the live API: `kernel browsers list` Triggered by: kernel/kernel-go-sdk@a156820 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps kernel-go-sdk to 6e62bf5b91e5d315b90b6c9c7296e09e312fb338. That SDK release reshapes the canonical managed-auth input field: the boolean `replace_existing` is gone and a `reason` enum ("missing" | "rejected") takes its place, so `auth connections get` and the `auth connections follow` event stream now render `reason=<why>` instead of the `replace-existing` marker. A rejected credential is still visible, now alongside the missing-value case it could not previously express. A full enumeration of api.md against the CLI's service interfaces and flags found no other coverage gaps: all 136 non-x-cli-skip SDK methods have commands, and every params field maps to an existing flag. Tested: auth connections list, auth connections get <id> (table + json), browsers create -t 60, browsers get <id>, browsers delete <id> against the live API; go build ./... and go test ./cmd/... pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps kernel-go-sdk to 796d4245c87a39acbb0d408b05f0de830c500772. That SDK release adds `interaction_id` to managed auth state and to the submit request. The API requires it for canonical submissions (field_values / selected_choice_id) and rejects it when paired with a legacy submit mode, so before this change every canonical `auth connections submit` failed with "interaction_id is required for canonical submissions". `auth connections submit` gains --interaction-id. Left off, the CLI reads the connection's current interaction ID, since the ID changes on every actionable pause and the freshly read one is the only sane default; passing it pins the submission so the API can reject it as stale. Legacy submit modes never send one, and --interaction-id with a legacy mode is rejected locally with the same rule the API enforces. `auth connections get` and `follow` now show the interaction ID next to the canonical fields and choices it scopes. Also resolves the stale merge of main into this branch, which had left two competing org entitlements implementations in cmd/org.go (the branch built `org entitlements get`; main shipped `org entitlements` in #232) so the package no longer compiled. Main's reviewed version wins. A full enumeration of api.md against the CLI found no other gaps: all 136 non-x-cli-skip SDK methods have commands, and the only new params field in this release is SubmitFieldsRequest.interaction_id. Tested against the live API: created a managed auth connection, started a login flow, and confirmed `get` (table + JSON) and `follow` render the interaction ID at AWAITING_INPUT; canonical submit with and without --interaction-id now clears the API's interaction validation (it stops at this org's submit-v2 feature gate, while the same request sent without interaction_id still returns "interaction_id is required"); legacy `--field` submit still accepted; `--interaction-id` with `--field` rejected locally; org entitlements, browsers create/get/delete pass. go build ./..., go vet ./... and go test ./... pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps kernel-go-sdk to v0.92.1-0.20260819203102-467fea72ee93, which adds the proxy_error browser telemetry event (BrowserProxyErrorEvent) to the telemetry event union. No CLI coverage gaps: a full enumeration of all 137 SDK methods in api.md found a corresponding CLI command for each, and the new event type needs no code change because the telemetry commands render category/type generically and accept --types values without a fixed allowlist. Tested: go build ./..., go vet ./..., go test ./... (all pass); browsers create --telemetry all, browsers curl, browsers telemetry events (table, --output json, --categories network --all, --types proxy_error), browsers telemetry stream --categories network --types proxy_error, browsers delete — all against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to 08023260493e4584c4d87638849ab4491b34ec49 (v0.93.0). The 0.93.0 release only changed version/changelog metadata relative to the SDK revision the CLI was already pinned to (467fea7); api.md and all generated Go sources are byte-identical, so there are no new methods, params, or fields to expose. Coverage analysis: full enumeration of all 140 SDK methods in api.md against the CLI command tree found no gaps. Every method has a command, and every param struct field is reachable via a flag, a positional arg, or a derived value. Tested: go build ./..., go vet ./..., go test ./... (all pass), plus live API smoke tests for browsers list/create/get/delete, browsers telemetry events, auth connections list, profiles list, telemetry destinations list. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…m split Updates kernel-go-sdk to 9a36566d8999ca346a9eeccede0cbf88d651b93f, which mirrors the control/platform telemetry split into the public API. BrowserTelemetryCategories gains a `platform` category and `control` becomes its own config type carrying `cdp.excluded_methods`, so the previous `p.Control = on()` no longer compiled. New coverage: - `--telemetry=platform` is now a settable category on browsers create/update, browser-pools create/update/acquire, and auth connections create/update/login, and is reported by the telemetry summaries and details tables. - `--telemetry-cdp-exclude` (new flag, same eight commands) sets BrowserTelemetryCdpControlConfigParam.ExcludedMethods. Values are the 38 CDP methods the proxy reports, matched case-insensitively and canonicalized; `--telemetry-cdp-exclude=none` sends an empty list to report every method again. Combining it with `--telemetry=off` is rejected, and on auth connection update/login it requires `--telemetry` in the same command, since a connection stores its browser config as sent and exclusions alone would drop its category selection. - Excluded methods are surfaced in the create/update telemetry summary, the browser-pool details table, and the auth connection details table. A full enumeration of the 140 methods in api.md against the CLI command tree found no missing commands. The x-cli-skip endpoints (site-configs, auth connection exchange) remain excluded. Tested against the live API: browsers create/update/delete with --telemetry=control,platform --telemetry-cdp-exclude (set, replace, and =none clear); browser-pools create/get/update/acquire/delete; auth connections create/get/update/delete; browsers telemetry events --categories platform; and the unknown-method, --telemetry=off, and missing---telemetry error paths. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… split Updates kernel-go-sdk to c0428370612f0ae242d9c4cbbf87e6a6436ff9d9. The previous update (f9b126f) targeted SDK commit 9a36566d8999, which is not reachable from the SDK's main branch — that telemetry control/platform split never landed. Against c042837 the CLI no longer compiled: BrowserTelemetryControlConfigParam, BrowserCdpCommandMethod, the `platform` category, and `control.cdp` do not exist. This reverts f9b126f's code changes, so the CLI is back to the nine categories the SDK actually ships (captcha, connection, console, control, interaction, network, page, screenshot, system) and the `--telemetry-cdp-exclude` flag is gone. The only API-surface change between the CLI's previous SDK and c042837 is browser_routing.go adding "computer" and "playwright" to the direct-to-VM routing allowlist — an internal default with no CLI-visible effect. Coverage analysis: a full enumeration of the 140 methods in api.md against the CLI command tree found no missing commands, and a field-by-field pass over every Params struct found no missing flags. The x-cli-skip endpoints (site-configs, auth connection exchange) remain excluded. Tested against the production API: - browsers create --telemetry=console,network / update --telemetry=page / telemetry events / get / delete - browser-pools create --telemetry=console / get / update --telemetry=network / delete - browsers create --telemetry-cdp-exclude now correctly rejects the removed flag - read-only sweep: auth context, auth connections list, browsers list, browser-pools list, app list, proxies list, profiles list, extensions list, org entitlements, telemetry destinations list, credentials list, projects list - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@c042837 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…orm split Updates kernel-go-sdk to 5e48c587a312453969141e879b8e34d60cd1ab0f. The supplied /tmp/sdk-diff.patch was empty: the SDK staging repo is a shallow clone that no longer contains c0428370612f, so the diff could not be computed. It was reconstructed by diffing the module cache copy of c042837 against the new tree. 5e48c58 sits on top of 9a36566, so the control/platform telemetry split is back in the SDK and the CLI stopped compiling on BrowserTelemetryCategoriesConfigParam.Control. This reverts 063d7f5's code changes, restoring f9b126f verbatim: - `--telemetry=platform` is a settable category again on browsers create/update, browser-pools create/update/acquire, and auth connections create/update/login, and is reported by the telemetry summaries and details tables. - `--telemetry-cdp-exclude` is back on those same eight commands, setting BrowserTelemetryCdpControlConfigParam.ExcludedMethods. Its 38 accepted values were re-verified field-by-field against the SDK's BrowserCdpCommandMethod enum and match exactly. `=none` clears the list; combining it with `--telemetry=off` is rejected, and auth connection update/login require `--telemetry` alongside it. Coverage analysis: api.md now lists 145 methods, up from 140. The five additions are the new SiteConfigs resource (Get, List, ListRecommendations, Lookup, Resolve); all five carry x-cli-skip: true in openapi.yaml and stay out of the CLI, as does the auth connection exchange endpoint. A leaf-by-leaf pass over the other 140 found no missing commands, and a field-level diff of every Params struct between the two SDK versions found no new flags beyond the telemetry ones above (the remaining additions are LookupRequestParam/ResolveRequestParam and SiteConfigList*Params, all skipped). Remaining SDK changes are comment-only or internal: the browser_routing direct-to-VM allowlist drops "computer" and "playwright", and BrowserNewParams.GPU documents a region=us-east requirement. Tested against the production API: - browsers create --telemetry=control,platform,console --telemetry-cdp-exclude (mixed case input canonicalized to Input.dispatchMouseEvent, Page.captureScreenshot), update replacing exclusions, update --telemetry-cdp-exclude=none to clear, then delete - browsers telemetry events --categories platform returns the new platform_api_call events - browser-pools create --telemetry=control,platform --telemetry-cdp-exclude / get (details table shows the exclusions) / update / delete - auth connections create --telemetry=control,platform --telemetry-cdp-exclude / update / delete - error paths: unknown CDP method, --telemetry=off with --telemetry-cdp-exclude, unknown category (lists platform), and cdp-exclude without --telemetry on auth connections update - read-only sweep: auth context, auth connections list, browsers list, browser-pools list, app list, proxies list, profiles list, extensions list, org entitlements, telemetry destinations list, credentials list, projects list - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@5e48c58 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… split Updates kernel-go-sdk to 26309b6ff244c7c729ed11101ada01757df34212. The supplied /tmp/sdk-diff.patch was empty, so the diff was recomputed by unshallowing the SDK clone. The result explains the churn: the CLI's previous pin, 5e48c587a312, is not on the SDK's main branch — it lives on origin/stlc/promotion-conflict, forked from 0802326. 26309b6 is on main, so moving to it removes the SiteConfigs resource and the control/platform telemetry split again, and the CLI stopped compiling on BrowserTelemetryControlConfigParam, BrowserCdpCommandMethod, the `platform` category, and `control.cdp`. This is the same situation 063d7f5 handled, so it reverts 484e19f's code changes, leaving cmd/ byte-identical to the 063d7f5 state (modulo the unrelated MCP install work merged from main since): - `--telemetry` is back to the nine categories the SDK actually ships (captcha, connection, console, control, interaction, network, page, screenshot, system); `platform` is rejected again. - `--telemetry-cdp-exclude` is gone from all eight commands (browsers create/update, browser-pools create/update/acquire, auth connections create/update/login). 26309b6 is c042837 plus lib/browserrouting/route_cache.go and its tests (stale-JWT eviction), so the public API surface is identical to c042837 and nothing new needs CLI coverage. Coverage analysis: api.md lists 140 methods, down from 145 — the five removals are the SiteConfigs resource, which carried x-cli-skip: true in openapi.yaml and was never in the CLI. All 140 remaining methods were checked one by one against CLI call sites and every one is reachable; the nine that looked unmatched at first (Deployments/Invocations/Auth.Connections.Follow, Browsers.Logs.Stream, Browsers.Telemetry.Stream, Browsers.Process.StdoutStream, Invocations.DeleteBrowsers/ListBrowsers, Browsers.Curl) all resolve to *Streaming variants or, for curl, a deliberate raw-HTTP-through-the-browser implementation. A field-level pass over all 100 Params structs reachable from api.md flagged only three candidates, all non-gaps: AuditLogListParams.PageToken is handled by ListAutoPaging, AuthConnectionLoginParams.BrowserTelemetry is the deprecated alias for the browser.telemetry the CLI already sets, and BrowserCurlParams.TimeoutMs / ResponseEncoding are unused because `browsers curl` streams raw bytes and maps the timeout onto --max-time. Tested against the production API: - browsers create --telemetry=console,network,control / get / update --telemetry=page / telemetry events / delete - browser-pools create --telemetry=console,control / get (details table shows the categories) / update --telemetry=network / delete - auth connections create --telemetry=console,control / update --telemetry=network / get / delete - removed surfaces now rejected: --telemetry=platform lists only the nine valid categories, and --telemetry-cdp-exclude is an unknown flag on both browsers create and auth connections update - read-only sweep: auth context, browsers list, browser-pools list, auth connections list, app list, proxies list, profiles list, extensions list, org entitlements, org limits get, telemetry destinations list, credentials list, projects list, api-keys list, credential-providers list, audit-logs search - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@26309b6 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…trol/platform split Updates kernel-go-sdk to 9de3679a3880b1fff724377144c60e26e630f7b0, which the SDK tags v0.94.0. The supplied /tmp/sdk-diff.patch was empty again, so the diff was recomputed from the SDK clone. 9de3679 merges the release-please branch onto 26309b6, and that merge brings back the surface the previous pin had dropped: the SiteConfigs resource (140 -> 145 configured endpoints) and the control/platform telemetry split. The CLI stopped compiling on BrowserTelemetryCategoriesConfigParam.Control, whose type changed from BrowserTelemetryCategoryConfigParam to BrowserTelemetryControlConfigParam. This is the same flip 484e19f handled, so it reverts 8b5a06b's code changes, leaving cmd/ byte-identical to the 484e19f state: - `--telemetry` accepts ten categories again (captcha, connection, console, control, interaction, network, page, platform, screenshot, system); `platform` is valid. - `--telemetry-cdp-exclude` is back on all eight commands (browsers create/update, browser-pools create/update/acquire, auth connections create/update/login), carrying control.cdp.excluded_methods. The CLI's 38-entry cdpCommandMethods list was diffed against the SDK's BrowserCdpCommandMethod enum at 9de3679 and is identical. Coverage analysis: api.md lists 145 methods, up from 140. All five additions are the SiteConfigs resource (Get, List, ListRecommendations, Lookup, Resolve), and every one carries x-cli-skip: true in openapi.yaml, so none needs a CLI command. The remaining 140 methods are unchanged from the previous pin and all resolve to CLI call sites. A field-level diff of every Params and Param struct between 26309b6 and 9de3679 found additions in only two places: the SiteConfig*Params / LookupRequestParam / ResolveRequestParam structs (skipped with their endpoints) and the telemetry structs restored here (BrowserTelemetryCategoriesConfigParam.Platform, BrowserTelemetryControlConfigParam.Enabled/Cdp, BrowserTelemetryCdpControlConfigParam.ExcludedMethods). The remaining SDK changes are doc-comment rewraps plus new response-only telemetry event types (cdp_command, page_crashed, platform_api_call), which need no flags because `telemetry events --types` filters on free-form strings. Tested against the production API: - browsers create --telemetry=console,control,platform --telemetry-cdp-exclude=Input.dispatchMouseEvent,Page.captureScreenshot — the response echoes platform.enabled and both excluded methods - browsers get --output json (telemetry block round-trips) / update --telemetry=network --telemetry-cdp-exclude=none (clears the list) / delete - browsers telemetry events showed a real platform_api_call event, and --categories platform filtered to it - browser-pools create --telemetry=console,control,platform --telemetry-cdp-exclude=Page.navigate / get (details row renders "excluding CDP methods: Page.navigate") / update --telemetry-cdp-exclude=none / delete - auth connections create --telemetry=console,control,platform --telemetry-cdp-exclude=Page.navigate / update --telemetry=network / delete - validation: --telemetry=bogus lists all ten categories, --telemetry=off with --telemetry-cdp-exclude is rejected, an unknown CDP method lists the 38 valid ones, and --telemetry-cdp-exclude without --telemetry is rejected on auth connections update - read-only sweep: auth context, browsers list, browser-pools list, auth connections list, app list, proxies list, profiles list, extensions list, org entitlements, org limits get, telemetry destinations list, credentials list, projects list, api-keys list, credential-providers list, audit-logs search - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@9de3679 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to v0.96.1-0.20260831004050-94c784ab3169 (94c784ab). SDK change is response-side only: ManagedAuthCanReauthReason gains a totp_reauth_allowed value and requirements_satisfiable is redocumented. The CLI renders CanReauthReason as a raw string in `auth connections get`/`list`, so the new value flows through with no code change. Coverage analysis: full enumeration of all 145 methods in api.md against the CLI command tree found no gaps. Every method has a command (the six config-registry and auth exchange endpoints are x-cli-skip), and every field across the 104 params structs maps to a flag or positional arg. Tested: go build ./..., go vet ./..., go test ./... all pass; `kernel auth connections list` and `kernel auth connections get <id>` against the live API render Can Reauth / Can Reauth Reason correctly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk from v0.96.1-0.20260831004050-94c784ab3169 to v0.97.0 (e9ee30b). The SDK delta is a release-only bump (CHANGELOG, README, version.go, release-please manifest); no API surface changed. Coverage analysis: enumerated all 145 methods in the SDK api.md and the full CLI command tree (153 commands). The only uncovered SDK methods are the ConfigRegistry endpoints (/config-registry, /lookup, /resolve, /analyses, /analyses/{id}), all marked x-cli-skip: true in openapi.yaml. Param-field cross-check surfaced no missing flags. Tested: go build ./..., go test ./... (all pass), and smoke-tested `kernel browsers list` and `kernel profiles list` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Updates github.com/kernel/kernel-go-sdk to v0.97.1-0.20260902190118-ed434f757fca (ed434f7). SDK changes covered: - New resource client.Browsers.Webmcp -> `kernel browsers webmcp` - `list-tools <id_or_name>` for client.Browsers.Webmcp.ListTools - `invoke-tool <id_or_name>` for client.Browsers.Webmcp.InvokeTool with --tool-ref, --input (JSON, '-' reads stdin), --timeout-sec for InvokeRequestParam.{ToolRef,Input,TimeoutSec} - All /browsers/{id_or_name} sub-resource routes now accept a browser session name. Migrated the renamed path param field (Params.ID -> Params.IDOrName) for replays stop/download, process kill/status/stdin/stdout-stream/resize, and fs watch stop/events, and synced the local service interface signatures to idOrName. Coverage analysis: full enumeration of api.md against the CLI command tree found no other gaps. ConfigRegistry endpoints are x-cli-skip. Tested against the live API: - browsers webmcp list-tools / invoke-tool: correct paths and flag handling; the API returns 404 because /browsers/*/webmcp/* is not deployed yet (verified identically via direct curl). - browsers replays list/start/stop/download, browsers process spawn/status/kill, browsers fs watch start/stop, browsers computer get-mouse-position -- all pass, addressed by session name. - go build ./... and go test ./... pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cursor · 2026-09-02T19:16:07Z

+			truncateURL(t.Source.PageURL, 40),
+			frame,
+			truncateURL(t.Description, 60),
+		})


Byte-sliced table truncation

Low Severity

The new WebMCP tools table shortens Description (and URLs) with truncateURL, which slices by bytes via s[:maxLen]. A max length that lands inside a multi-byte UTF-8 character produces a garbled trailing sequence in the terminal table. This violates the project's rune-aware truncation rule for CLI table display strings.

^{Triggered by learned rule: Use rune-aware truncation for CLI table display strings}

^{Reviewed by Cursor Bugbot for commit fc5ba82. Configure here.}

The SDK diff from the CLI's previous pin (ed434f7) to d02140d is a release-only bump: .release-please-manifest.json, CHANGELOG.md, README.md and internal/version.go. No API surface changed. Full enumeration of api.md (147 methods) against the CLI command tree found no coverage gaps. The 5 /config-registry methods are marked x-cli-skip in openapi.yaml; the remaining 142 all have CLI commands, and every *Params field (including the nested *RequestParam structs and the ProxyNewParams config union variants) maps to an existing flag. Tested: go build ./..., go test ./... (all pass), and live API smoke tests of `browsers list`, `profiles list`, `app list`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… health Updates github.com/kernel/kernel-go-sdk to v0.98.1-0.20260903142348-7a377c78440a (7a377c7). The only SDK change since v0.98.0 is on the OtlpDestination response, which gained consecutive_failures, last_error, last_error_at and last_export_at. No new endpoints or request params, so a full enumeration of api.md against the command tree turned up no missing commands or flags. 'kernel telemetry destinations get/create/update' now print Delivery, Consecutive Failures, Last Export At, Last Error and Last Error At, and 'list' gained a Delivery column. Delivery keys off consecutive_failures alone, since last_error/last_error_at are retained after a later success and would otherwise read as a live failure. Tested against the live API: telemetry destinations create/get/list/delete, get -o json (health fields pass through), and a browser session created with --telemetry-export-otlp. The API reported consecutive_failures 0 with no health timestamps throughout, so the healthy and never-delivered paths are covered live and the failing and retained-error paths by unit tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Update kernel-go-sdk to 31c5fee384421d8c66f9c8bb5e5ef0c0ac7e194a, which adds the Vaults resource (11 endpoints) and links vaults to browser sessions. New commands (kernel vaults): - create, get, list, delete for client.Vaults.{Upsert,Get,List,Delete} - items {create,get,list,update,delete,events,perform-operation} for client.Vaults.Items.* Vault item specs are discriminated unions spanning four provider variants, so they are taken as JSON via --spec / --spec-file (matching the --chrome-policy convention) rather than a flag per provider-conditional field. New flags: - browsers create --vault for BrowserNewParams.Vaults (repeatable, ID or name) - browsers get now shows Vaults and Usage Status for the new response fields vaults list uses the page-based pagination UX (--page/--per-page + footer). Tested against the real API: vaults create/get/list/delete (incl. pagination footer), items create for wallet(link), wallet(agentcard) and card(agentcard) via both --spec and --spec-file -, items get (incl. --wait/--expand), list, update (verified persisted), events (incl. --after/--wait), perform-operation, delete; browsers create --vault by both name and ID, verified the Vaults row in browsers get and Usage Status on a deleted session. All test resources cleaned up. go build, go vet and go test ./... pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

Bumps github.com/kernel/kernel-go-sdk from 31c5fee to v0.99.0 (b228059). That range is the release commit only — release metadata and changelog, no API surface — so the vault commands already on this branch cover every method in api.md that is not marked x-cli-skip. A full enumeration of api.md against the CLI found no other gaps: the only endpoints without commands are the Config Registry ones and /auth/connections/{id}/exchange, all x-cli-skip. What this commit adds on top of the version bump: - cmd/vaults_test.go: coverage for the new commands, which shipped without any. Pins the list pagination contract (limit = per-page + 1, the extra item trimmed before display, footer and Next hint), the wallet/card spec discrimination for items create/update, --spec vs --spec-file, --wait / --expand / --after plumbing, and the delete confirmations. The two delete paths get the non-interactive fail-fast tests the repo requires of any command that can prompt. - cmd/browsers_test.go: --vault maps Kernel-shaped values to IDs and anything else to names, and drops blanks. - README.md: a Vaults section in the command reference (vaults and vault items, with spec examples) and the browsers create --vault flag. Tested against the production API with the bumped SDK: vaults create/get/list/delete, items create (wallet+agentcard via --spec), list/get (incl. --wait), events, perform-operation (409 as expected for an unauthorized wallet), delete, and browsers create --vault — verified the Vaults row in browsers get and Usage Status on the deleted session. All test resources cleaned up. go build, go vet and go test ./... pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…cards) Bumps github.com/kernel/kernel-go-sdk from v0.99.0 to v0.99.1-0.20260904193100-6ec0643c8bd4. SDK changes in this range are confined to vaultitem.go: - CardVaultItemSpecLink{,Param}.Test removed (test-mode card creation is no longer supported; cards are live-only), along with the union accessor CardVaultItemSpecUnionParam.GetTest and the Test response fields. - VaultItemService.PerformOperation documents a new 429 `spend_request_rate_limited` provider error. No CLI changes were required: - The CLI never referenced the Test field. `kernel vaults items create/update` accept the provider spec as raw JSON via --spec/--spec-file and unmarshal straight into CardVaultItemSpecUnionParam, so the field removal needs no flag or help-text edit (no test-mode references exist anywhere in the repo). Coverage analysis: full enumeration of all 158 methods in the SDK api.md against cmd/. 153 require CLI coverage and all are covered; the 5 exceptions are the config-registry endpoints marked x-cli-skip in openapi.yaml. Three SSE endpoints (browsers logs stream, process stdout stream, telemetry stream) are covered via their *Streaming SDK variants. Param fields were enumerated transitively from every *Params struct; the only unreferenced fields are deprecated ones already superseded in the CLI (AuthConnectionLoginParams .BrowserTelemetry/.Proxy -> params.Browser.Telemetry/.Proxy) and BrowserCurlParams.TimeoutMs/ResponseEncoding, which do not apply because `kernel browsers curl` intentionally proxies raw HTTP through the SDK browser transport (--max-time covers the timeout; encoding is moot when streaming bytes). Tested against the production API: vaults list, vaults get, vaults items list, vaults items get (card/link item deserializes correctly without the removed test field), vaults items events, browsers list, app list, profiles list. go build, go vet, and go test ./... all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Re-pins github.com/kernel/kernel-go-sdk from the pseudo-version v0.99.1-0.20260904193100-6ec0643c8bd4 (set in b4ac39e) to the tagged release v0.100.0. 07e74ed is the merge commit that release-please tagged as v0.100.0, so this is the same code under a proper semver tag rather than a commit pseudo-version. No API-surface change relative to b4ac39e; the vault card `test` field removal was already analysed and required no CLI change, since vault item specs are passed through as raw JSON via --spec/--spec-file. Re-verified after the bump: full enumeration of api.md (158 methods) against the CLI command tree found no missing commands (the 5 /config-registry endpoints are x-cli-skip in openapi.yaml), and a field-level sweep of all 114 *Params structs against every command's flags found no missing flags. Tested: go build ./... and go test ./... pass; `vaults list`, `vaults items list`, and `vaults items get` on a provider=link card item all return correct output against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to v0.100.1-0.20260905183853-4b985afe0962 (kernel/kernel-go-sdk@4b985af), which adds `features.vaults` to the org entitlements response, and shows it as a new "Vaults" row in `kernel org entitlements`. Also repairs three regressions left by the "Merge main into cli-coverage-update" commit, which broke the build and the CLI at startup: - BrowsersCreateInput lost its TelemetryCdpExclude field while runBrowsersCreate still referenced it (compile error); restored the field and its wiring so `browsers create --telemetry-cdp-exclude` works again. - `browsers create` registered --vault twice, panicking on every command ("create flag redefined: vault"); kept main's StringArray registration, which is what the flag reader uses. - `browsers create` mapped vault references twice, sending each vault to the API twice; kept main's buildBrowserVaults (limit, duplicate, and name validation) and dropped the inline copy. A full enumeration of api.md against the CLI command tree found no other coverage gaps; all config-registry endpoints are marked x-cli-skip. Tested against the live API: `org entitlements` (Vaults row + JSON), `browsers create --telemetry-cdp-exclude` (verified excluded_methods in `browsers get`), `browsers create --vault` (single attachment), `vaults create/delete`, `browsers delete`. `go build ./...`, `go vet ./...`, and `go test ./...` all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to v0.100.1-0.20260905202137-8abbe5e87d79 (kernel/kernel-go-sdk@8abbe5e), which caps free organizations at three vaults and adds the fields that report that cap. The SDK diff adds no new methods and no new request params, only three response fields, so this surfaces them in the commands that already render those payloads: - `kernel org limits get` gains "Max Vaults" and "Vaults Used" rows from OrgLimits.MaxVaults / OrgLimits.VaultsUsed. Both are guarded on field presence like the managed auth rows, and a null max_vaults (paid plans and active trials) renders as "unlimited". - `kernel org entitlements` gains a "Max vaults" limit row from OrgEntitlementsLimits.MaxVaults, also unlimited-aware. - `kernel vaults create` gets a Long description carrying the new SDK method comment: the three-vault free cap, that paid plans and trials are uncapped, and that retrieving an existing vault by name still succeeds at the limit. - `kernel org limits get` help now mentions vault limits and usage, matching the updated OrganizationLimitService.Get comment. A full enumeration of api.md (158 method entries) against the CLI command tree (168 leaf commands) found no other coverage gaps; all five config-registry endpoints and /auth/connections/{id}/exchange are marked x-cli-skip. Tested against the live API: `org limits get` (table + JSON show Max Vaults unlimited, Vaults Used 7), `org entitlements` (Max vaults row + JSON), and a `vaults create` / `vaults delete --yes` round trip that moved vaults_used 7 -> 8 -> 7. `go build ./...`, `go vet ./...`, and `go test ./...` all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0632a7a. Configure here.}

cursor · 2026-09-05T20:32:11Z

+	// Vault limits are plan-derived and, like the managed auth rows above, only
+	// returned by newer API versions. A null max_vaults means unlimited.
+	if orgLimitFieldPresent(limits.JSON.MaxVaults) {
+		rows = append(rows, []string{"Max Vaults", formatProjectLimitValue(limits.MaxVaults, limits.JSON.MaxVaults)})


Malformed vault cap shown unlimited

Low Severity

renderOrgLimits formats MaxVaults with formatProjectLimitValue, which treats every non-Valid() respjson state as unlimited. After the presence check, an explicit null is unlimited, but a malformed max_vaults value is also shown as unlimited and overstates the org cap. formatEntitlementLimitValue in the same file already distinguishes null from decode failure.

^{Triggered by learned rule: Distinguish explicit null from omitted/malformed in respjson fields}

^{Reviewed by Cursor Bugbot for commit 0632a7a. Configure here.}

kernel-internal Bot changed the title ~~CLI: Update SDK to 0a28735 and add new commands/flags~~ CLI: Update Go SDK to a1568205c576686eeafc634fff0ea72b75c28c0e Aug 17, 2026

kernel-internal Bot and others added 2 commits August 18, 2026 21:08

Merge main into cli-coverage-update

6412b6f

kernel-internal Bot changed the title ~~CLI: Update Go SDK to a1568205c576686eeafc634fff0ea72b75c28c0e~~ CLI: Update Go SDK to 6e62bf5b91e5d315b90b6c9c7296e09e312fb338 Aug 18, 2026

kernel-internal Bot and others added 2 commits August 19, 2026 18:53

Merge main into cli-coverage-update

055d6a9

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 6e62bf5b91e5d315b90b6c9c7296e09e312fb338~~ CLI: Update SDK to 796d4245c87a39acbb0d408b05f0de830c500772 and add new commands/flags Aug 19, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to 796d4245c87a39acbb0d408b05f0de830c500772 and add new commands/flags~~ CLI: Update Go SDK to 467fea72ee93a0d8e4a520169cf5e14e5d4076ee Aug 19, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 467fea72ee93a0d8e4a520169cf5e14e5d4076ee~~ CLI: Update Go SDK to 08023260493e4584c4d87638849ab4491b34ec49 Aug 20, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 08023260493e4584c4d87638849ab4491b34ec49~~ CLI: Update SDK to 9a36566 and add new commands/flags Aug 21, 2026

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread cmd/browsers_telemetry.go

kernel-internal Bot changed the title ~~CLI: Update SDK to 9a36566 and add new commands/flags~~ CLI: Update Go SDK to c0428370612f0ae242d9c4cbbf87e6a6436ff9d9 Aug 21, 2026

kernel-internal Bot and others added 2 commits August 24, 2026 18:25

Merge main into cli-coverage-update

f777871

kernel-internal Bot changed the title ~~CLI: Update Go SDK to c0428370612f0ae242d9c4cbbf87e6a6436ff9d9~~ CLI: Update SDK to 5e48c58 and add new commands/flags Aug 24, 2026

cursor Bot reviewed Aug 24, 2026

View reviewed changes

Comment thread cmd/browsers_telemetry.go

kernel-internal Bot and others added 2 commits August 24, 2026 20:07

Merge main into cli-coverage-update

76455e6

kernel-internal Bot changed the title ~~CLI: Update SDK to 5e48c58 and add new commands/flags~~ CLI: Update Go SDK to 26309b6ff244c7c729ed11101ada01757df34212 Aug 24, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 26309b6ff244c7c729ed11101ada01757df34212~~ CLI: Update SDK to 9de3679 (v0.94.0) and restore the telemetry control/platform flags Aug 24, 2026

cursor Bot reviewed Aug 24, 2026

View reviewed changes

Comment thread cmd/browsers_telemetry.go

archandatta mentioned this pull request Aug 25, 2026

Document current browser telemetry categories kernel/docs#474

Merged

kernel-internal Bot changed the title ~~CLI: Update Go SDK to bb4371c5e6a87c968baf33168e5e0941d10b92b7~~ CLI: Update Go SDK to 6e498fbbc12d5992adbcceba6638398457a1aca9 Aug 28, 2026

cursor Bot reviewed Aug 28, 2026

View reviewed changes

Comment thread cmd/auth_connections.go

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 6e498fbbc12d5992adbcceba6638398457a1aca9~~ CLI: Update Go SDK to 94c784ab31693069f07fab5c627c635555591fc8 Aug 31, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 94c784ab31693069f07fab5c627c635555591fc8~~ CLI: Update Go SDK to e9ee30b2922a628d7f457d49e8706dc0b69d98af Aug 31, 2026

kernel-internal Bot and others added 2 commits September 2, 2026 19:05

Merge main into cli-coverage-update

d21ec11

kernel-internal Bot changed the title ~~CLI: Update Go SDK to e9ee30b2922a628d7f457d49e8706dc0b69d98af~~ CLI: Update SDK to ed434f757fcaf78316cfdf198fda59124bda0500 and add new commands/flags Sep 2, 2026

cursor Bot reviewed Sep 2, 2026

View reviewed changes

kernel-internal Bot changed the title ~~CLI: Update SDK to ed434f757fcaf78316cfdf198fda59124bda0500 and add new commands/flags~~ CLI: Update Go SDK to d02140d40065d15fa5bdce9fe6c4867143cabeb1 Sep 2, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to d02140d40065d15fa5bdce9fe6c4867143cabeb1~~ CLI: Update SDK to 7a377c78440a30f919ba811712b06e929e8223a2 and surface OTLP destination delivery health Sep 3, 2026

kernel-internal Bot and others added 2 commits September 4, 2026 18:22

Merge main into cli-coverage-update

2bc63e8

kernel-internal Bot changed the title ~~CLI: Update SDK to 7a377c78440a30f919ba811712b06e929e8223a2 and surface OTLP destination delivery health~~ CLI: Update SDK to 31c5fee384421d8c66f9c8bb5e5ef0c0ac7e194a and add vaults commands Sep 4, 2026

cursor Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread cmd/vaults.go Outdated

kernel-internal Bot changed the title ~~CLI: Update SDK to 31c5fee384421d8c66f9c8bb5e5ef0c0ac7e194a and add vaults commands~~ CLI: Update SDK to b228059a65b43101996f7612a2d6ff4fca9b442d and add new commands/flags Sep 4, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to b228059a65b43101996f7612a2d6ff4fca9b442d and add new commands/flags~~ CLI: Update SDK to 6ec0643c8bd44f8f615c5789760ed4b3d1071c0d and add new commands/flags Sep 4, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to 6ec0643c8bd44f8f615c5789760ed4b3d1071c0d and add new commands/flags~~ CLI: Update Go SDK to 07e74ed716226de1c39e67adc16115e1b6aaa738 (v0.100.0) Sep 4, 2026

kernel-internal Bot and others added 2 commits September 5, 2026 18:43

Merge main into cli-coverage-update

09b13b7

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 07e74ed716226de1c39e67adc16115e1b6aaa738 (v0.100.0)~~ CLI: Update SDK to 4b985afe0962cb38ec029b0b7769411c0632bd79 and add new commands/flags Sep 5, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to 4b985afe0962cb38ec029b0b7769411c0632bd79 and add new commands/flags~~ CLI: Update SDK to 8abbe5e87d792f63c11f20c9c3ebe8046457ad4a and add new commands/flags Sep 5, 2026

cursor Bot reviewed Sep 5, 2026

View reviewed changes

Navigation Menu

Uh oh!

CLI: Update SDK to 8abbe5e87d792f63c11f20c9c3ebe8046457ad4a and add new commands/flags - #231

CLI: Update SDK to 8abbe5e87d792f63c11f20c9c3ebe8046457ad4a and add new commands/flags#231
kernel-internal[bot] wants to merge 38 commits into
mainfrom
cli-coverage-update

kernel-internal Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot Sep 2, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Sep 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

kernel-internal Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SDK Update

Coverage Analysis

New Output Coverage

Help Text

Testing

Uh oh!

socket-security Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot Sep 2, 2026

Choose a reason for hiding this comment

Byte-sliced table truncation

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 5, 2026

Choose a reason for hiding this comment

Malformed vault cap shown unlimited

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

kernel-internal Bot commented Aug 17, 2026 •

edited

Loading

socket-security Bot commented Aug 17, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading