CLI: Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a by kernel-internal[bot] · Pull Request #296 · kernel/cli

kernel-internal · 2026-10-13T22:34:54Z

Summary

Update the Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a.

Coverage

CLI coverage report

Summary

Updated github.com/kernel/kernel-go-sdk from v0.126.1-0.20261016123619-126a86281d29 to v0.127.0. The tag resolves to SDK commit 721b8dc53e92d9b7326f30174d71fe5f15c0f21a.
Added no new command names and no new flag names.
Expanded the existing --memory flag on the following commands to accept the new headless allocations 1GiB, 2GiB, and 4GiB, while retaining headful 8GiB and 16GiB support:
- kernel browsers create
- kernel browser-pools create
- kernel browser-pools update
Updated those three flags' help text with the headless/headful value sets and defaults from BrowserMemoryRequest, BrowserPoolNewParams.memory, and BrowserPoolUpdateParams.memory in the API specification.

Enumeration and gap analysis

The full SDK and CLI inventories were rebuilt rather than relying only on the release diff:

SDK: 175 methods from api.md, including 124 methods with parameter structs and 410 direct parameter fields.
Applicable SDK surface: 169 methods and 400 direct parameter fields after excluding six Config Registry methods marked x-cli-skip.
CLI: 233 commands total, including 205 visible runnable commands, with every command's local flags enumerated.
Result: all 169 applicable SDK methods map to runnable CLI commands. Direct fields were checked against command flags, positional arguments, page-based pagination controls, and structured JSON inputs such as --spec-file and --params.

Missing commands

None.

Missing flags

None after this update. The only newly uncovered user-facing gap was the expanded set of values accepted by existing --memory flags.

Other SDK release changes checked

BrowserPoolUpdateParams.ExpectedNetwork is already exposed as kernel browser-pools update --expected-network, including preservation of explicit empty collections.
Credential field-definition updates are exposed through kernel vaults credentials update --spec-file: add_fields, remove_fields, and the passkey field type now serialize through the updated generated SDK. A contract test covers this path.
The new captcha telemetry media response field and binance provider value require no input flag. Telemetry JSON output passes through complete event payloads.
Link card expires_at request input was already absent from CLI card-spec help and input guidance.
Updated vault recovery, credential-field, and Kernel-card behavior described by this release was already reflected in the existing command help. No unrelated help text was restyled.

Intentional exclusions

The OpenAPI document contains eight operations marked x-cli-skip: true:

GET /config-registry
POST /config-registry/lookup
POST /config-registry/resolve
GET /config-registry/analyses
GET /config-registry/analyses/{id}
POST /config-registry/analyses/{id}/cancel
POST /mpp/browsers
POST /auth/connections/{id}/exchange

The six Config Registry operations appear in api.md and were intentionally excluded from CLI command coverage. The MPP browser and auth exchange operations are not exposed as methods in this SDK release.

Validation

go mod tidy — passed.
go test ./... — passed.
go build ./... — passed.
Built ./cmd/kernel outside the checkout and verified all three affected help pages list 1GiB, 2GiB, 4GiB, 8GiB, and 16GiB.
Real API smoke tests — passed:
- Created a headless 1GiB browser, retrieved it and verified headless: true and memory: 1GiB, then deleted it.
- Created a headless 1GiB browser pool, updated it to 2GiB, retrieved and verified the new configuration, then force-deleted it.
- Created a temporary vault credential, updated its definitions with add_fields using type passkey and remove_fields, retrieved and verified the resulting definition, then deleted the temporary vault and its items.

All smoke-test resources were cleaned up, and all test output and binaries were kept outside the checkout.

Validation

Go build
Go vet
Go tests

Note

Medium Risk
Touches payment/vault recovery guidance, credential schema updates, and scoped API key policies—areas where misconfiguration or wrong recovery steps have real operational impact.

Overview
Bumps kernel-go-sdk to v0.127.0 and wires through the new API surface in the CLI, with README and vault help aligned to the same behavior.

API keys: kernel api-keys create gains --expires-at (RFC 3339, mutually exclusive with --days-to-expire) and repeatable --policy-statement ACTION=RESOURCE for scoped keys; create/get output now shows policy statements.

Browsers & pools: Existing --memory accepts headless sizes 1GiB / 2GiB / 4GiB in addition to headful 8GiB / 16GiB on browsers create and browser-pools create|update. browser-pools update --expected-network sends optimistic concurrency on pool network config (409 stale_network warning).

Vaults: Credential update docs and help cover add_fields / remove_fields and the passkey field type. confirm_transaction and Kernel card amount ceilings move to 1,000,000 minor units. Recovery, Kernel fill timing, and card-replacement guidance are updated across vault commands and README.

Tests cover API key parsing, memory sizes, expected-network JSON, credential field-definition updates, and confirm_transaction validation.

^{Reviewed by Cursor Bugbot for commit 909dccf. Bugbot is set up for automated code reviews on this repo. Configure here.}

SDK change is documentation-only (BrowserPlaywrightService.Execute comment). Full enumeration of SDK methods vs CLI commands found no coverage gaps (config-registry endpoints are x-cli-skip). Tested: go build ./... (no new commands/flags to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bump kernel-go-sdk to v0.124.0 (80a3ce3). Full SDK/CLI coverage enumeration found no gaps; no new commands or flags needed. Tested: go build ./... (version bump only, no new commands to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…PI key expiry/policy flags - Bump kernel-go-sdk to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 - api-keys create: add --expires-at (APIKeyNewParams.ExpiresAt) and repeatable --policy-statement ACTION=RESOURCE (APIKeyNewParams.Policy) - api-keys get/create: show the key's policy (APIKey.Policy) Tested: api-keys create --expires-at, api-keys create --project-id --policy-statement 'browsers:use=projects/<id>/*', api-keys get (Policy row rendered), mutual-exclusion and parse-error validation, cleanup via api-keys delete. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

SDK change is release metadata only (v0.125.0); full enumeration of api.md methods vs CLI commands found no coverage gaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

socket-security · 2026-10-14T00:02:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/kernel/kernel-go-sdk@v0.126.0 ⏵ v0.127.0	⁺¹

View full report

- Bump kernel-go-sdk to e7ab5d320b3e3324e4c73394d4506ed4e5059495 - vaults items invoke <vault> <key> authorize now accepts --params/--spec-file with browser_id and page_url (AuthorizeVaultItemOperationRequestParam.BrowserID, .PageURL); both together or neither; rejected locally for kernel cards - fill fields are now optional (FillVaultItemOperationRequestParam.Fields no longer required); up to 32 bindings when the item requires them - Surface wallet item description (VaultItemWallet.Description) in items get output (json and text) Tested: go test ./...; built binary and checked help text, authorize param validation (browser_id without page_url rejected locally; valid params reach the API), fill without fields reaches the API, vaults items get json against the real API. Live Link authorize was not exercised to avoid initiating real payments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

Bump kernel-go-sdk to v0.126.0 (3296561). The SDK diff since e7ab5d320b3e contains only release metadata; full enumeration found no coverage gaps. Tested: go build ./... (version bump only, no new commands/flags) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ove and passkeys Bump kernel-go-sdk to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd, which adds the passkey credential field type and add_fields/remove_fields on credential vault item updates. `vaults credentials update --spec-file` already passes the spec through CredentialVaultItemSpecUpdateParam, so the new fields work as-is; update the help text, example, and README (definitions are no longer immutable; passkey type rules). Also fix the earlier merge of main, which duplicated the authorize field in vaultOperationParams and broke the build. Take main's authorize handling (--browser-id/--page-url from #298), which supersedes this branch's --params variant, and drop its now-obsolete test. Tested: vaults create; vaults credentials create (text/password fields); vaults credentials update with add_fields (totp + passkey), fields values, and remove_fields -> version 2, ready, fields username/otp/pk; vaults items get; vaults delete. go build ./..., go vet ./cmd, go test ./cmd pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

cursor · 2026-10-15T00:08:54Z

+	for _, statement := range key.Policy.Statements {
+		lines = append(lines, statement.Action+" on "+statement.Resource)
+	}
+	return strings.Join(lines, "\n")


Extra policy statements not displayed

Medium Severity

formatAPIKeyPolicy joins statements with newlines, but PrintTableNoPad only prints the first line of each cell. Human create and get output therefore drop every statement after the first, so a multi-statement key looks narrower than it is.

Additional Locations (2)

cmd/api_keys.go#L384-L385

cmd/api_keys.go#L400-L401

^{Reviewed by Cursor Bugbot for commit 247c1d1. Configure here.}

Update kernel-go-sdk to c01e7cb515705a9e8a82a6334b6b88727f649ced (v0.126.1-0.20261015002534-c01e7cb51570). The SDK change is documentation-only (Kernel card details delivered through fill). No new methods or params. CLI help text now matches it: fill delivers card details for a few minutes, submit checkout promptly, repeated fill is safe, and supported cards without an agentic network token are authorized without a one-time code. Coverage: full enumeration of all api.md methods against CLI commands; no gaps (config-registry endpoints are x-cli-skip). Tested: go build, go vet, go test ./cmd; vaults list against the live API; vaults items invoke --help and vaults cards create --help render the updated text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

- Bump kernel-go-sdk to aaa851dc850d81283fbe553be52a759de4842b39 - Remove expires_at from the LinkCardSpec help and README; the API and SDK no longer accept it (mirrors the help/test change in #299) No new SDK methods or param fields; full enumeration found no gaps (config-registry endpoints are x-cli-skip). Tested: go test ./..., vaults cards create --help (LinkCardSpec has no expires_at), vaults list against the real API Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…o 1000000 - Bump kernel-go-sdk to c5435759242aaa83f6280dcd3506c8dd185752ae - Kernel card spec help: amount is now 1..1000000 minor units ($10,000) - confirm_transaction: accept amounts up to 1000000 minor units, matching ConfirmTransactionVaultItemOperationRequest.amount in the API spec No new SDK methods or param fields; full api.md enumeration found no gaps (config-registry analyses remain x-cli-skip). Tested: go build ./..., go test ./cmd/ (boundary tests moved to 1000000/1000001) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ected-network Bump github.com/kernel/kernel-go-sdk to 4ba1a16b77cf49e77fb755de50602e9ceb96f767. Add `kernel browser-pools update --expected-network <json>` for BrowserPoolUpdateParams.ExpectedNetwork, an atomic optimistic-concurrency precondition on the pool's network configuration. The JSON object is sent raw so explicit empty lists (distinct from omitted lists to the API) are preserved. A 409 stale_network response prints a hint to re-read the pool. Tested against the live API: - browser-pools update --expected-network '{}' --private-host ... (pool with no network) -> success - browser-pools update --expected-network '{}' --size 2 (network changed) -> 409 stale_network, pool unchanged - browser-pools update --expected-network "<network from get -o json>" --clear-private-hosts -> success - browser-pools update --expected-network null -> rejected client-side - go test ./... passes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f240749. Configure here.}

cursor · 2026-10-15T22:19:23Z

+		var apiErr *kernel.Error
+		if expectedNetwork != nil && errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusConflict {
+			pterm.Warning.Println("The pool's network configuration no longer matches --expected-network; nothing was updated. Re-read it with 'kernel browser-pools get <id-or-name> -o json' and retry.")
+		}


409 hint uses placeholder pool id

Medium Severity

The stale_network 409 path prints a pterm.Warning whose retry command uses the placeholder <id-or-name> instead of in.IDOrName, then returns CleanedUpSdkError. Command errors need to be one sentence with the real identifier; wrapping *kernel.Error makes the root handler re-render code: message and drop any hint. Any pool-update 409 is also treated as a stale network match.

^{Triggered by learned rule: CLI errors: single-line; Playwright 409 uses real id}

^{Reviewed by Cursor Bugbot for commit f240749. Configure here.}

Bump github.com/kernel/kernel-go-sdk to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde. The SDK change is doc-only, but it reflects an API behavior change: Link and Kernel cards in recovery_required for issuance may now be deleted and replaced (deleting cancels the known original request). Update the CLI recovery guidance (items get/invoke warnings, cards create/update help, README) so it no longer says such cards must never be deleted or replaced, and so uncertain updates point to delete-and-recreate instead of "must not be retried". Kernel recovery while reporting a merchant transaction still requires support. Coverage: full enumeration of api.md methods against CLI commands found no gaps (config-registry endpoints are x-cli-skip). No params changed. Tested: go build, go vet, go test ./cmd; vaults cards update --help shows the new guidance; vaults list against the live API. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to a7500dba27215b13133ab42299f42720aaefd952. The SDK change only touches browser telemetry response types (new captcha 'media' field, 'binance' captcha provider value); no new methods or params, so no new CLI commands/flags are needed. Full enumeration of api.md methods vs. CLI commands found no coverage gaps (config-registry endpoints are x-cli-skip). Tested: go build ./... (version bump only; no new commands to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…erage

kernel-internal Bot and others added 2 commits October 13, 2026 22:34

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 99b6c2b2751cf65675a01d172e79a0e58a321155~~ CLI: Update Go SDK to 80a3ce316e4f298419b9e14561d12abce778d344 Oct 13, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 80a3ce316e4f298419b9e14561d12abce778d344~~ CLI: Update SDK to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 and add new commands/flags Oct 13, 2026

CLI: Update Go SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b

1ecbae5

SDK change is release metadata only (v0.125.0); full enumeration of api.md methods vs CLI commands found no coverage gaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel-internal Bot changed the title ~~CLI: Update SDK to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 and add new commands/flags~~ CLI: Update SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b and add new commands/flags Oct 14, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b and add new commands/flags~~ CLI: Update SDK to e7ab5d320b3e3324e4c73394d4506ed4e5059495 and add new commands/flags Oct 14, 2026

cursor Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread cmd/vaults_operation_params.go Outdated

kernel-internal Bot changed the title ~~CLI: Update SDK to e7ab5d320b3e3324e4c73394d4506ed4e5059495 and add new commands/flags~~ CLI: Update SDK to 3296561611713cb31143d25f2d7a75beb39a87bb and add new commands/flags Oct 14, 2026

kernel-internal Bot and others added 2 commits October 15, 2026 00:01

Merge main into cli-coverage-update

63a5db2

kernel-internal Bot changed the title ~~CLI: Update SDK to 3296561611713cb31143d25f2d7a75beb39a87bb and add new commands/flags~~ CLI: Update SDK to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

kernel-internal Bot changed the title ~~CLI: Update SDK to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd and add new commands/flags~~ CLI: Update SDK to c01e7cb515705a9e8a82a6334b6b88727f649ced and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread cmd/vaults_help.go

kernel-internal Bot changed the title ~~CLI: Update SDK to c01e7cb515705a9e8a82a6334b6b88727f649ced and add new commands/flags~~ CLI: Update SDK to aaa851dc850d81283fbe553be52a759de4842b39 and add new commands/flags Oct 15, 2026

kernel-internal Bot and others added 3 commits October 15, 2026 20:21

Merge main into cli-coverage-update

643333a

README: raise Kernel card amount cap to 1000000 minor units

394ae96

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel-internal Bot changed the title ~~CLI: Update SDK to aaa851dc850d81283fbe553be52a759de4842b39 and add new commands/flags~~ CLI: Update SDK to c5435759242aaa83f6280dcd3506c8dd185752ae and add new commands/flags Oct 15, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to c5435759242aaa83f6280dcd3506c8dd185752ae and add new commands/flags~~ CLI: Update SDK to 4ba1a16b77cf49e77fb755de50602e9ceb96f767 and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

kernel-internal Bot changed the title ~~CLI: Update SDK to 4ba1a16b77cf49e77fb755de50602e9ceb96f767 and add new commands/flags~~ CLI: Update SDK to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde and add new commands/flags Oct 15, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde and add new commands/flags~~ CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags Oct 15, 2026

Update Go SDK to 126a86281d291ffa25bf281fd172b0663eff09b0 and CLI cov…

07462c3

…erage

kernel-internal Bot changed the title ~~CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags~~ CLI: Update Go SDK to 126a86281d291ffa25bf281fd172b0663eff09b0 Oct 16, 2026

Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a and CLI cov…

909dccf

…erage

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 126a86281d291ffa25bf281fd172b0663eff09b0~~ CLI: Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a Oct 16, 2026

Navigation Menu

Repository navigation

CLI: Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a - #296

CLI: Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a#296
kernel-internal[bot] wants to merge 18 commits into
mainfrom
cli-coverage-update

kernel-internal Bot commented Oct 13, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot Oct 15, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Oct 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

kernel-internal Bot commented Oct 13, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Coverage

CLI coverage report

Summary

Enumeration and gap analysis

Missing commands

Missing flags

Other SDK release changes checked

Intentional exclusions

Validation

Validation

Uh oh!

socket-security Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Oct 15, 2026

Choose a reason for hiding this comment

Extra policy statements not displayed

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 15, 2026

Choose a reason for hiding this comment

409 hint uses placeholder pool id

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

kernel-internal Bot commented Oct 13, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Oct 14, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading