CLI: Update Go SDK to 425e8f86fe7eaab16e76865246a3b4b90bb44a46 - #231
Open
kernel-internal[bot] wants to merge 75 commits into
Open
kernel-internal[bot] wants to merge 75 commits into
kernel-internal[bot] wants to merge 75 commits into
Conversation
Bump github.com/kernel/kernel-go-sdk to v0.91.1-0.20260817203807-0a287359dcc5 (0a28735). Coverage gap found by enumerating all 140 methods in the SDK's api.md against the CLI command tree: the new Organization.Entitlements resource had no CLI surface. Everything else was already covered. New command: - `kernel org entitlements get` for client.Organization.Entitlements.Get (GET /org/entitlements). Renders Plan, Features, and Limits sections; supports --output json. Null constraint values mean unlimited in this API, and the SDK models them as non-pointer int64, so rendering keys off respjson field validity rather than the zero value. Tested against the real API: - kernel org entitlements get (table output, ENTERPRISE plan) - kernel org entitlements get --output json - kernel org entitlements get --output yaml (rejected as expected) - go build ./... and go test ./... pass, including 5 new unit tests covering populated constraints, null-as-unlimited, null plan fields, invalid --output, and API errors. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Updates github.com/kernel/kernel-go-sdk from
v0.91.1-0.20260817203807-0a287359dcc5 to v0.92.0.
## Coverage Analysis
Diffing the two module sources shows the SDK API surface is byte-identical
between these versions -- the only changes are release metadata
(.release-please-manifest.json, CHANGELOG.md, README.md, internal/version.go).
A full enumeration was still performed:
- All 140 SDK methods in api.md have corresponding CLI commands.
- The 4 x-cli-skip endpoints (/site-configs/lookup, /site-configs/resolve,
/site-configs/analyses/{id}, /auth/connections/{id}/exchange) are absent
from the SDK surface, so nothing to skip.
- All params struct fields are covered by CLI flags except three, each
intentional:
- AuthConnectionLoginParams.BrowserTelemetry -- deprecated in favor of
browser.telemetry, which the CLI already uses via ManagedAuthBrowserConfigParam.
- AuditLogListParams.PageToken -- opaque cursor handled internally by
ListAutoPaging; CLI exposes --limit instead.
- BrowserCurlParams.TimeoutMs / ResponseEncoding -- `browsers curl` is
implemented against browsers.HTTPClient rather than the SDK curl endpoint;
--max-time covers the timeout and raw bytes are streamed, so response
encoding is not applicable.
No coverage gaps found; no new commands or flags added.
## Tested
- go build ./... and go vet ./... clean
- go test ./... all packages pass
- Smoke tested rebuilt binary against the live API: `kernel browsers list`
Triggered by: kernel/kernel-go-sdk@a156820
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to 6e62bf5b91e5d315b90b6c9c7296e09e312fb338.
That SDK release reshapes the canonical managed-auth input field: the
boolean `replace_existing` is gone and a `reason` enum ("missing" |
"rejected") takes its place, so `auth connections get` and the
`auth connections follow` event stream now render `reason=<why>` instead
of the `replace-existing` marker. A rejected credential is still visible,
now alongside the missing-value case it could not previously express.
A full enumeration of api.md against the CLI's service interfaces and
flags found no other coverage gaps: all 136 non-x-cli-skip SDK methods
have commands, and every params field maps to an existing flag.
Tested: auth connections list, auth connections get <id> (table + json),
browsers create -t 60, browsers get <id>, browsers delete <id> against
the live API; go build ./... and go test ./cmd/... pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to 796d4245c87a39acbb0d408b05f0de830c500772. That SDK release adds `interaction_id` to managed auth state and to the submit request. The API requires it for canonical submissions (field_values / selected_choice_id) and rejects it when paired with a legacy submit mode, so before this change every canonical `auth connections submit` failed with "interaction_id is required for canonical submissions". `auth connections submit` gains --interaction-id. Left off, the CLI reads the connection's current interaction ID, since the ID changes on every actionable pause and the freshly read one is the only sane default; passing it pins the submission so the API can reject it as stale. Legacy submit modes never send one, and --interaction-id with a legacy mode is rejected locally with the same rule the API enforces. `auth connections get` and `follow` now show the interaction ID next to the canonical fields and choices it scopes. Also resolves the stale merge of main into this branch, which had left two competing org entitlements implementations in cmd/org.go (the branch built `org entitlements get`; main shipped `org entitlements` in #232) so the package no longer compiled. Main's reviewed version wins. A full enumeration of api.md against the CLI found no other gaps: all 136 non-x-cli-skip SDK methods have commands, and the only new params field in this release is SubmitFieldsRequest.interaction_id. Tested against the live API: created a managed auth connection, started a login flow, and confirmed `get` (table + JSON) and `follow` render the interaction ID at AWAITING_INPUT; canonical submit with and without --interaction-id now clears the API's interaction validation (it stops at this org's submit-v2 feature gate, while the same request sent without interaction_id still returns "interaction_id is required"); legacy `--field` submit still accepted; `--interaction-id` with `--field` rejected locally; org entitlements, browsers create/get/delete pass. go build ./..., go vet ./... and go test ./... pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to v0.92.1-0.20260819203102-467fea72ee93, which adds the proxy_error browser telemetry event (BrowserProxyErrorEvent) to the telemetry event union. No CLI coverage gaps: a full enumeration of all 137 SDK methods in api.md found a corresponding CLI command for each, and the new event type needs no code change because the telemetry commands render category/type generically and accept --types values without a fixed allowlist. Tested: go build ./..., go vet ./..., go test ./... (all pass); browsers create --telemetry all, browsers curl, browsers telemetry events (table, --output json, --categories network --all, --types proxy_error), browsers telemetry stream --categories network --types proxy_error, browsers delete — all against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to 08023260493e4584c4d87638849ab4491b34ec49 (v0.93.0). The 0.93.0 release only changed version/changelog metadata relative to the SDK revision the CLI was already pinned to (467fea7); api.md and all generated Go sources are byte-identical, so there are no new methods, params, or fields to expose. Coverage analysis: full enumeration of all 140 SDK methods in api.md against the CLI command tree found no gaps. Every method has a command, and every param struct field is reachable via a flag, a positional arg, or a derived value. Tested: go build ./..., go vet ./..., go test ./... (all pass), plus live API smoke tests for browsers list/create/get/delete, browsers telemetry events, auth connections list, profiles list, telemetry destinations list. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
…m split Updates kernel-go-sdk to 9a36566d8999ca346a9eeccede0cbf88d651b93f, which mirrors the control/platform telemetry split into the public API. BrowserTelemetryCategories gains a `platform` category and `control` becomes its own config type carrying `cdp.excluded_methods`, so the previous `p.Control = on()` no longer compiled. New coverage: - `--telemetry=platform` is now a settable category on browsers create/update, browser-pools create/update/acquire, and auth connections create/update/login, and is reported by the telemetry summaries and details tables. - `--telemetry-cdp-exclude` (new flag, same eight commands) sets BrowserTelemetryCdpControlConfigParam.ExcludedMethods. Values are the 38 CDP methods the proxy reports, matched case-insensitively and canonicalized; `--telemetry-cdp-exclude=none` sends an empty list to report every method again. Combining it with `--telemetry=off` is rejected, and on auth connection update/login it requires `--telemetry` in the same command, since a connection stores its browser config as sent and exclusions alone would drop its category selection. - Excluded methods are surfaced in the create/update telemetry summary, the browser-pool details table, and the auth connection details table. A full enumeration of the 140 methods in api.md against the CLI command tree found no missing commands. The x-cli-skip endpoints (site-configs, auth connection exchange) remain excluded. Tested against the live API: browsers create/update/delete with --telemetry=control,platform --telemetry-cdp-exclude (set, replace, and =none clear); browser-pools create/get/update/acquire/delete; auth connections create/get/update/delete; browsers telemetry events --categories platform; and the unknown-method, --telemetry=off, and missing---telemetry error paths. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
… split Updates kernel-go-sdk to c0428370612f0ae242d9c4cbbf87e6a6436ff9d9. The previous update (f9b126f) targeted SDK commit 9a36566d8999, which is not reachable from the SDK's main branch — that telemetry control/platform split never landed. Against c042837 the CLI no longer compiled: BrowserTelemetryControlConfigParam, BrowserCdpCommandMethod, the `platform` category, and `control.cdp` do not exist. This reverts f9b126f's code changes, so the CLI is back to the nine categories the SDK actually ships (captcha, connection, console, control, interaction, network, page, screenshot, system) and the `--telemetry-cdp-exclude` flag is gone. The only API-surface change between the CLI's previous SDK and c042837 is browser_routing.go adding "computer" and "playwright" to the direct-to-VM routing allowlist — an internal default with no CLI-visible effect. Coverage analysis: a full enumeration of the 140 methods in api.md against the CLI command tree found no missing commands, and a field-by-field pass over every Params struct found no missing flags. The x-cli-skip endpoints (site-configs, auth connection exchange) remain excluded. Tested against the production API: - browsers create --telemetry=console,network / update --telemetry=page / telemetry events / get / delete - browser-pools create --telemetry=console / get / update --telemetry=network / delete - browsers create --telemetry-cdp-exclude now correctly rejects the removed flag - read-only sweep: auth context, auth connections list, browsers list, browser-pools list, app list, proxies list, profiles list, extensions list, org entitlements, telemetry destinations list, credentials list, projects list - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@c042837 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
…orm split Updates kernel-go-sdk to 5e48c587a312453969141e879b8e34d60cd1ab0f. The supplied /tmp/sdk-diff.patch was empty: the SDK staging repo is a shallow clone that no longer contains c0428370612f, so the diff could not be computed. It was reconstructed by diffing the module cache copy of c042837 against the new tree. 5e48c58 sits on top of 9a36566, so the control/platform telemetry split is back in the SDK and the CLI stopped compiling on BrowserTelemetryCategoriesConfigParam.Control. This reverts 063d7f5's code changes, restoring f9b126f verbatim: - `--telemetry=platform` is a settable category again on browsers create/update, browser-pools create/update/acquire, and auth connections create/update/login, and is reported by the telemetry summaries and details tables. - `--telemetry-cdp-exclude` is back on those same eight commands, setting BrowserTelemetryCdpControlConfigParam.ExcludedMethods. Its 38 accepted values were re-verified field-by-field against the SDK's BrowserCdpCommandMethod enum and match exactly. `=none` clears the list; combining it with `--telemetry=off` is rejected, and auth connection update/login require `--telemetry` alongside it. Coverage analysis: api.md now lists 145 methods, up from 140. The five additions are the new SiteConfigs resource (Get, List, ListRecommendations, Lookup, Resolve); all five carry x-cli-skip: true in openapi.yaml and stay out of the CLI, as does the auth connection exchange endpoint. A leaf-by-leaf pass over the other 140 found no missing commands, and a field-level diff of every Params struct between the two SDK versions found no new flags beyond the telemetry ones above (the remaining additions are LookupRequestParam/ResolveRequestParam and SiteConfigList*Params, all skipped). Remaining SDK changes are comment-only or internal: the browser_routing direct-to-VM allowlist drops "computer" and "playwright", and BrowserNewParams.GPU documents a region=us-east requirement. Tested against the production API: - browsers create --telemetry=control,platform,console --telemetry-cdp-exclude (mixed case input canonicalized to Input.dispatchMouseEvent, Page.captureScreenshot), update replacing exclusions, update --telemetry-cdp-exclude=none to clear, then delete - browsers telemetry events --categories platform returns the new platform_api_call events - browser-pools create --telemetry=control,platform --telemetry-cdp-exclude / get (details table shows the exclusions) / update / delete - auth connections create --telemetry=control,platform --telemetry-cdp-exclude / update / delete - error paths: unknown CDP method, --telemetry=off with --telemetry-cdp-exclude, unknown category (lists platform), and cdp-exclude without --telemetry on auth connections update - read-only sweep: auth context, auth connections list, browsers list, browser-pools list, app list, proxies list, profiles list, extensions list, org entitlements, telemetry destinations list, credentials list, projects list - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@5e48c58 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
… split Updates kernel-go-sdk to 26309b6ff244c7c729ed11101ada01757df34212. The supplied /tmp/sdk-diff.patch was empty, so the diff was recomputed by unshallowing the SDK clone. The result explains the churn: the CLI's previous pin, 5e48c587a312, is not on the SDK's main branch — it lives on origin/stlc/promotion-conflict, forked from 0802326. 26309b6 is on main, so moving to it removes the SiteConfigs resource and the control/platform telemetry split again, and the CLI stopped compiling on BrowserTelemetryControlConfigParam, BrowserCdpCommandMethod, the `platform` category, and `control.cdp`. This is the same situation 063d7f5 handled, so it reverts 484e19f's code changes, leaving cmd/ byte-identical to the 063d7f5 state (modulo the unrelated MCP install work merged from main since): - `--telemetry` is back to the nine categories the SDK actually ships (captcha, connection, console, control, interaction, network, page, screenshot, system); `platform` is rejected again. - `--telemetry-cdp-exclude` is gone from all eight commands (browsers create/update, browser-pools create/update/acquire, auth connections create/update/login). 26309b6 is c042837 plus lib/browserrouting/route_cache.go and its tests (stale-JWT eviction), so the public API surface is identical to c042837 and nothing new needs CLI coverage. Coverage analysis: api.md lists 140 methods, down from 145 — the five removals are the SiteConfigs resource, which carried x-cli-skip: true in openapi.yaml and was never in the CLI. All 140 remaining methods were checked one by one against CLI call sites and every one is reachable; the nine that looked unmatched at first (Deployments/Invocations/Auth.Connections.Follow, Browsers.Logs.Stream, Browsers.Telemetry.Stream, Browsers.Process.StdoutStream, Invocations.DeleteBrowsers/ListBrowsers, Browsers.Curl) all resolve to *Streaming variants or, for curl, a deliberate raw-HTTP-through-the-browser implementation. A field-level pass over all 100 Params structs reachable from api.md flagged only three candidates, all non-gaps: AuditLogListParams.PageToken is handled by ListAutoPaging, AuthConnectionLoginParams.BrowserTelemetry is the deprecated alias for the browser.telemetry the CLI already sets, and BrowserCurlParams.TimeoutMs / ResponseEncoding are unused because `browsers curl` streams raw bytes and maps the timeout onto --max-time. Tested against the production API: - browsers create --telemetry=console,network,control / get / update --telemetry=page / telemetry events / delete - browser-pools create --telemetry=console,control / get (details table shows the categories) / update --telemetry=network / delete - auth connections create --telemetry=console,control / update --telemetry=network / get / delete - removed surfaces now rejected: --telemetry=platform lists only the nine valid categories, and --telemetry-cdp-exclude is an unknown flag on both browsers create and auth connections update - read-only sweep: auth context, browsers list, browser-pools list, auth connections list, app list, proxies list, profiles list, extensions list, org entitlements, org limits get, telemetry destinations list, credentials list, projects list, api-keys list, credential-providers list, audit-logs search - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@26309b6 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
…trol/platform split Updates kernel-go-sdk to 9de3679a3880b1fff724377144c60e26e630f7b0, which the SDK tags v0.94.0. The supplied /tmp/sdk-diff.patch was empty again, so the diff was recomputed from the SDK clone. 9de3679 merges the release-please branch onto 26309b6, and that merge brings back the surface the previous pin had dropped: the SiteConfigs resource (140 -> 145 configured endpoints) and the control/platform telemetry split. The CLI stopped compiling on BrowserTelemetryCategoriesConfigParam.Control, whose type changed from BrowserTelemetryCategoryConfigParam to BrowserTelemetryControlConfigParam. This is the same flip 484e19f handled, so it reverts 8b5a06b's code changes, leaving cmd/ byte-identical to the 484e19f state: - `--telemetry` accepts ten categories again (captcha, connection, console, control, interaction, network, page, platform, screenshot, system); `platform` is valid. - `--telemetry-cdp-exclude` is back on all eight commands (browsers create/update, browser-pools create/update/acquire, auth connections create/update/login), carrying control.cdp.excluded_methods. The CLI's 38-entry cdpCommandMethods list was diffed against the SDK's BrowserCdpCommandMethod enum at 9de3679 and is identical. Coverage analysis: api.md lists 145 methods, up from 140. All five additions are the SiteConfigs resource (Get, List, ListRecommendations, Lookup, Resolve), and every one carries x-cli-skip: true in openapi.yaml, so none needs a CLI command. The remaining 140 methods are unchanged from the previous pin and all resolve to CLI call sites. A field-level diff of every Params and Param struct between 26309b6 and 9de3679 found additions in only two places: the SiteConfig*Params / LookupRequestParam / ResolveRequestParam structs (skipped with their endpoints) and the telemetry structs restored here (BrowserTelemetryCategoriesConfigParam.Platform, BrowserTelemetryControlConfigParam.Enabled/Cdp, BrowserTelemetryCdpControlConfigParam.ExcludedMethods). The remaining SDK changes are doc-comment rewraps plus new response-only telemetry event types (cdp_command, page_crashed, platform_api_call), which need no flags because `telemetry events --types` filters on free-form strings. Tested against the production API: - browsers create --telemetry=console,control,platform --telemetry-cdp-exclude=Input.dispatchMouseEvent,Page.captureScreenshot — the response echoes platform.enabled and both excluded methods - browsers get --output json (telemetry block round-trips) / update --telemetry=network --telemetry-cdp-exclude=none (clears the list) / delete - browsers telemetry events showed a real platform_api_call event, and --categories platform filtered to it - browser-pools create --telemetry=console,control,platform --telemetry-cdp-exclude=Page.navigate / get (details row renders "excluding CDP methods: Page.navigate") / update --telemetry-cdp-exclude=none / delete - auth connections create --telemetry=console,control,platform --telemetry-cdp-exclude=Page.navigate / update --telemetry=network / delete - validation: --telemetry=bogus lists all ten categories, --telemetry=off with --telemetry-cdp-exclude is rejected, an unknown CDP method lists the 38 valid ones, and --telemetry-cdp-exclude without --telemetry is rejected on auth connections update - read-only sweep: auth context, browsers list, browser-pools list, auth connections list, app list, proxies list, profiles list, extensions list, org entitlements, org limits get, telemetry destinations list, credentials list, projects list, api-keys list, credential-providers list, audit-logs search - go build ./..., go vet ./..., go test ./... all pass Triggered by: kernel/kernel-go-sdk@9de3679 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
kernel-internal
Bot
changed the title
Bumps kernel-go-sdk to 2e5c06117d8597f1808b3bd43a4df746a19fe8c7, which adds
ManagedAuthBrowserConfig.Region ("Honor managed auth browser regions").
Exposes it as --region on `kernel auth connections create`, `update`, and
`login`, reusing the existing parseRegionFlag validation so the accepted values
match `kernel browsers create` (us-east, eu-west, ap-southeast). `auth
connections get` and `follow` now show a "Browser Region" row when the API
reports one.
A full enumeration of api.md methods against the CLI command tree found no
other gaps; the config-registry endpoints remain x-cli-skip.
Tested against the live API: create --region us-east round-trips into the get
output, update --region us-east succeeds, update --region eu-west returns the
API's region_not_enabled entitlement error (confirming the field is sent), and
an invalid value is rejected client-side on create, update, and login.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Release-only bump from 2e5c06117d85 to 1682e8f1d567ee65eb51128eae27dd64411a3b3c (v0.103.0). Diffing the two module versions shows changes confined to CHANGELOG.md, README.md, internal/version.go, and the release manifest — the generated API surface is unchanged, so no new commands or flags are required. Full enumeration of api.md (163 methods, 158 after excluding x-cli-skip endpoints) against the CLI found no coverage gaps: - Every non-skipped method is wired through the CLI's service interfaces. - Every top-level Params field is referenced except AuditLogListParams.PageToken (handled internally by ListAutoPaging) and the deprecated AuthConnectionLoginParams.BrowserTelemetry (superseded by browser.telemetry, which the CLI already uses). Tested: go build ./..., go vet ./..., go test ./... all pass; smoke tested against production with auth status, app list, and browsers create/get/delete (session mpf174rvn2bi8j8ijyk2f0ox created and cleaned up). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
The SDK now models credential vault items alongside wallets and cards, adds the collect operation, and replaces VaultCardFillFieldUnionParam with the generic VaultFillFieldParam (page_url is now optional). New commands: - kernel vaults credentials create <vault> <key> --spec '<json>' (--values-file <path|->, --open) for CredentialVaultItemRequest - kernel vaults credentials update <vault> <key> --version <n> (--values-file, --description, --expected-item-id, --open) for CredentialVaultItemUpdateRequest - kernel vaults items invoke <vault> <key> collect for CollectVaultItemOperationRequest; --open opens the hosted form URL Credential values are write-only, so they are read from a file or stdin and rejected in --spec and in shell arguments. Update takes the expected item version, so a concurrent edit returns 409 instead of being overwritten. Fill now accepts credential items: page_url may be omitted (requiring exactly one open page), field names are declared credential fields, and format is rejected. Card bindings keep their existing constraints, now enforced once the item type is known instead of at parse time. Item output renders credential schema and per-field presence, withholding sensitive values, and the JSON projection gained a wildcard so caller-declared field maps survive filtering. A full enumeration of api.md against the CLI found no other gaps: the only uncovered methods are the five ConfigRegistry endpoints, all x-cli-skip. Tested against the live API: vaults credentials create (with and without --values-file), credentials update (set, clear via null, description-only, stale --version 409), items get/list -o json, items invoke collect, and items invoke fill for both a text/password credential and a totp field (verified a generated 6-digit code reached the page, not the seed). Test resources were deleted afterwards. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates kernel-go-sdk to v0.103.1-0.20260914235606-55c88c0144a0. The only API change in this range is ManagedAuthField.input_mode, a virtual keyboard hint that is independent of the field type and of browser validation. auth connections get and follow now show it alongside the type, so a numeric one-time code reads as `code, input_mode=numeric, ref=totp_code, required`. The credential vault item work in the previous commit already covers the rest of this SDK version; a full enumeration of api.md against the CLI found no other gaps. Tested: go build, go vet, and the full test suite pass against the new SDK; auth connections list and get were exercised against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to v0.103.1-0.20260915001710-bcf94cc5a1bd (bcf94cc). The only SDK change since the CLI's previous pin (55c88c0) is a new `working_configurations` response field on ConfigRegistryResponse and LookupResponse. All /config-registry endpoints are marked x-cli-skip in the API spec, so no CLI surface changes are required. A full enumeration of api.md methods against the CLI command tree found no other gaps. Tested: go build ./..., go vet ./..., go test ./... (all pass); smoke tested `kernel browsers list` and `kernel profiles list --per-page 3` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Update kernel-go-sdk to v0.103.1-0.20260915150632-f0d32931f752 (kernel/kernel-go-sdk@f0d3293, "disable automatic vault operation retries in SDKs"). The SDK change sets option.WithMaxRetries(0) inside VaultItemService.PerformOperation. The CLI already passes WithMaxRetries(0) explicitly on every vault call, including Items.PerformOperation (cmd/vaults.go:271), so no CLI change was needed and the caller option still takes precedence. Also repair cmd/vaults_output.go, which did not compile on this branch. The earlier "Merge main into cli-coverage-update" (a7ef20d) resolved printVaultItemGuidance by keeping this branch's `switch item.Type` header while taking main's `} else {` tail, producing a syntax error and silently dropping the `case "credential"` arm, which left printVaultCredentialGuidance unreachable. Restored the switch arms and kept main's updated card recovery wording. Coverage analysis: full enumeration of all 163 methods in the SDK api.md against the 175 CLI leaf commands. No gaps. The 5 ConfigRegistry methods are x-cli-skip in openapi.yaml and are correctly absent. Tested: go build ./..., go vet ./..., go test ./... -count=1 (all pass); against the live API exercised the restored credential path end to end - vaults create --name, vaults credentials create, vaults items get (human + -o json), vaults items list, vaults items delete, vaults delete. Confirmed the pending_collection warning and update guidance now render, sensitive values stay withheld in both outputs, and test resources were cleaned up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates github.com/kernel/kernel-go-sdk from v0.103.1-0.20260915150632-f0d32931f752 to v0.104.0. The upstream change is a release-only commit: diffing the two module trees shows changes solely in CHANGELOG.md, README.md, .release-please-manifest.json and internal/version.go. No API surface changed. A full enumeration was still performed: - 163 SDK methods extracted from api.md; all map to existing CLI commands, except the 5 config-registry methods and auth/connections/exchange which are marked x-cli-skip in openapi.yaml. - 117 *Params structs screened field-by-field against CLI flags. All remaining differences are naming/shape only, e.g. KioskMode -> --kiosk, TimeoutSeconds -> --timeout, FillRatePerMinute -> --fill-rate, AcquireTimeoutSeconds -> --timeout, HoldKeys -> --hold-key, Keys -> --key, MaxDurationInSeconds -> --max-duration, LastEventID -> --seq, BypassHosts -> --bypass-host, EnvVars -> --env/--env-file, Async -> --sync, and path/positional params (IDOrName, AppName, ActionName, EntrypointRelPath). No new commands or flags were needed. Tested: go build ./... passes; smoke tested `kernel browsers list` and `kernel profiles list` against the live API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Bumps github.com/kernel/kernel-go-sdk to fe4b49f374669ebbc5244be04f136488576e49f7. A full enumeration of the 163 SDK methods in api.md against the CLI command tree found no missing commands or flags (the 5 config-registry methods are x-cli-skip). The one behavioral gap is the new InvocationResult status: `kernel browsers webmcp invoke` treated every non-completed status as a failure, so a non-autosubmit declarative form tool reported "awaiting_submission" as an error with empty error text. It now prints the tool output and warns that the form was populated but not submitted, pointing at Playwright or computer interaction to submit it rather than re-invoking the tool. Command help text reflects the same semantics. Tested: browsers create/get/list/delete, browsers webmcp list, browsers webmcp invoke (error path) against the live API; awaiting_submission covered by unit test (needs a WebMCP form page to reach live). Full `go test ./...` passes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
The only functional SDK change is the new awaiting_submission value on InvocationResultStatus for WebMCP tool invocations, which the CLI already handles in cmd/browsers_webmcp.go. The rest of the release is documentation. Full enumeration of api.md (163 methods) against the CLI found no coverage gaps. The 5 config-registry methods are marked x-cli-skip in openapi.yaml; the remaining 158 all have CLI commands. Tested: go build, go vet, go test ./... all pass; smoke tested `browsers list`, `profiles list`, and `browsers webmcp invoke --help` against the live API with the new SDK. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Update github.com/kernel/kernel-go-sdk to aac4d0c (v0.105.1-0.20260915195748-aac4d0c60651). The only API change is a new nullable `intent` response field on config-registry analyses, and every /config-registry endpoint carries x-cli-skip, so no command or flag changes were needed. A full enumeration of api.md against the CLI command tree found no other coverage gaps. Repair the fallout from merging main (#252, #253) into this branch. Git auto-merged two independent variants of the vault credential work into code that did not parse (an orphaned `case "credential":` after an `if`, a duplicate `preparation` map key) and into call sites that referenced functions from the other variant. Main's reviewed versions supersede the bot-authored drafts, so the vault subsystem is taken from main verbatim, along with its README sections. Branch-only work that main lacks is kept: auth connections login regained its dropped TelemetryCdpExclude input field, the `--interaction-id` submit flag stays documented, and the items invoke table row keeps its prepare_checkout/collect coverage. Tested: go build ./..., go test ./... (all green), plus live API smoke tests of vaults create, vaults credentials create/update --spec-file, vaults items get/get -o json/events/delete, vaults delete, browsers list, and auth connections login --telemetry-cdp-exclude validation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3e75e7d. Configure here.
…aration Bumps kernel-go-sdk to cbf9d2b (v0.105.1-0.20260915204831-cbf9d2b797ef). AgentCard checkout preparation is no longer Square-only. VaultCheckoutContextParam gains an optional Psp field (square, braintree, worldpay, bambora, mercado_pago) and Environment gains "shared"; AgentcardCheckoutPreparation echoes the bound Psp. - vaults items invoke prepare_checkout accepts checkout.psp and validates it against the processor enum. Omitting it keeps Square compatibility. - checkout.environment now accepts shared alongside production and sandbox. Environment/processor pairing stays server-side, since the API owns processor enablement. - Preparation output gains psp in the JSON projection and a Processor row in the table. - Help text and README document the processors, the shared environment, and that merchant_origin is the merchant document origin rather than a processor iframe. A full enumeration of api.md against the CLI found no other gaps: every SDK method maps to a command except the config-registry endpoints, which are all marked x-cli-skip. Tested: go test ./... passes. Against the live API, vaults items get renders psp as Processor in both table and JSON output for a real prepared AgentCard item; prepare_checkout rejects an unknown psp client-side with no API call and accepts psp=bambora with environment=shared through to the server-side availability gate. A live end-to-end prepare_checkout was not run, since no existing item advertises the operation and creating one would mint real single-use payment consent; the request body including psp and shared is asserted in cmd/vaults_prepare_checkout_test.go. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates github.com/kernel/kernel-go-sdk to
v0.105.1-0.20260916004326-425e8f86fe7e (commit 425e8f8, "Polish and
publish the Config Registry API").
Coverage analysis: a full enumeration of the 164 SDK methods in api.md
against the CLI command tree found no gaps. The only new SDK method in
this bump is client.ConfigRegistry.Analyses.Cancel
(POST /config-registry/analyses/{id}/cancel), which is marked
x-cli-skip: true in openapi.yaml -- as are all other /config-registry
endpoints -- so no CLI command is added. The remaining SDK changes are
response-shape edits on Config Registry types (Evidence.last_verified_at
renamed to last_supported_at, Recommendation.verification removed), and
the CLI does not reference those types.
Tested: go build ./... and go test ./... pass; smoke tested
`kernel browsers list` and `kernel profiles list` against the live API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates the Go SDK dependency to the latest version.
SDK Update
v0.105.1-0.20260916004326-425e8f86fe7e)Coverage Analysis
A full enumeration of SDK methods and CLI commands was performed. No coverage gaps were found.
api.mdwere extracted and mapped against the full CLI command tree.client.ConfigRegistry.Analyses.Cancel(POST /config-registry/analyses/{id}/cancel). It is markedx-cli-skip: trueinopenapi.yaml, as are all other/config-registryendpoints, so no CLI command is added for it.Evidence.last_verified_atrenamed tolast_supported_at,Recommendation.verificationremoved). The CLI does not reference those types, so nothing needed updating.Testing
go build ./...andgo test ./...pass.kernel browsers listandkernel profiles listagainst the live API.Triggered by: kernel/kernel-go-sdk@425e8f8
Reviewer: @kernel-internal[bot]
Note
Medium Risk
Changes managed-auth submit binding and payment-preparation parameters that must stay aligned with API semantics; breadth is mostly CLI validation and display, but mistakes could cause stale submissions or wrong checkout context.
Overview
Bumps kernel-go-sdk and expands the CLI for newer API fields across vault checkout, managed auth, browser telemetry, and org limits.
Vault / AgentCard checkout:
prepare_checkoutJSON now accepts optionalcheckout.psp(square, braintree, worldpay, bambora, mercado_pago) andcheckout.environmentshared, with client-side validation and human/JSON output showing Processor. README and vault help document multi-processor prep andcollect/ broaderinvokebehavior.Managed auth:
auth connections submitadds--interaction-id(canonical with--field-value/--choice-id); the CLI auto-fetches the current interaction when omitted. Interaction ID and richer field metadata (input_mode,reason) appear inget/follow.--telemetry-cdp-excludeis wired on create/update/login for auth connections (and similarly on browsers and browser pools).Browsers & telemetry: New
platformtelemetry category; CDP method exclusions merge into control telemetry with validation and display. Browsergetshows linked vaults and usage status for deleted sessions; create forwards vault ID/name references. WebMCP invoke treatsawaiting_submissionas success with guidance instead of an error.Other:
kernel invokeprintsstatus_reasonon failed invocations; OTLP destinations list/get show delivery health;org limits/ entitlements include vault caps; proxy create help clarifies ISP country support.Reviewed by Cursor Bugbot for commit 50d35df. Bugbot is set up for automated code reviews on this repo. Configure here.