CLI: Update Go SDK to b9653c8e152c2469fcf4d036937ae0ad2c75b9fa by kernel-internal[bot] · Pull Request #296 · kernel/cli

kernel-internal · 2026-10-13T22:34:54Z

Summary

Update the Go SDK to b9653c8e152c2469fcf4d036937ae0ad2c75b9fa.

Coverage

CLI Coverage Update Report

SDK update

Updated github.com/kernel/kernel-go-sdk from v0.129.0 to v0.129.1-0.20261022224405-b9653c8e152c (commit b9653c8e152c2469fcf4d036937ae0ad2c75b9fa).
Refreshed go.sum with the new module checksums.

Coverage review

/tmp/sdk-diff.patch contains no SDK method, signature, parameter, or field changes.
Enumerated all 175 methods in api.md and inspected their parameter structs:
- 169 methods require CLI coverage.
- 6 methods are intentionally excluded by x-cli-skip: true.
- 124 methods have generated parameter structs, comprising 402 direct fields; nested parameter models and union variants were also inspected.
Enumerated the live Cobra tree: 236 CLI command paths and their flags.
Mapped every non-skipped SDK method to an existing CLI command, including integrated streaming behavior such as invocation follow and specialized vault commands.
Reviewed parameter coverage, including same-name flags, CLI-oriented aliases, positional arguments, page-based pagination, and structured JSON/file inputs for complex union payloads.

Gap analysis

Missing commands

None.

Missing flags

None.

Complex request models intentionally remain exposed through established structured inputs such as --request, --spec, --spec-file, --params, and --json rather than hundreds of provider- or union-specific leaf flags. Positional resource identifiers and command arguments also continue to represent SDK path/body fields where appropriate.

Help text review

No help text changes were required.

The OpenAPI diff did not provide a baseline and requested comparison against the current specification. Current summaries and descriptions for exposed operations and fields were reviewed against the existing command and flag help. Because the SDK/API diff contains no generated method, field, or description change, no exposed help text was found to require an update in this release.

Intentional exclusions

The following SDK operations are marked x-cli-skip: true in openapi.yaml and remain intentionally unavailable in the CLI:

GET /config-registry
POST /config-registry/lookup
POST /config-registry/resolve
GET /config-registry/analyses
GET /config-registry/analyses/{id}
POST /config-registry/analyses/{id}/cancel

The specification also marks the machine-payment browser endpoint, card-capture protocol endpoints, and auth handoff exchange endpoint as both CLI-skipped and Stainless-skipped; they do not appear as SDK methods in api.md.

Validation

Passed:

go mod tidy
go build ./...
go test ./...
go build -o /home/runner/work/_temp/cli-scratch/kernel ./cmd/kernel
git diff --check origin/main

Real-API smoke tests were skipped as directed because this update adds no commands or flags; it only updates the SDK dependency.

Validation

Go build
Go vet
Go tests

Note

Medium Risk
Adds API key policy scoping and optimistic concurrency on browser/pool network updates; vault and card limit/recovery guidance changes affect payment and credential workflows.

Overview
Bumps kernel-go-sdk and wires new API surface into the CLI, with large README and vault help alignment.

API keys: api-keys create adds --expires-at (RFC 3339, mutually exclusive with --days-to-expire) and repeatable --policy-statement ACTION=RESOURCE for scoped keys; create/get output shows policy.

Browsers & pools: Create/update support session --locale / --timezone (and clear on update); list/get show locale/timezone and allowlist revision state. Allowlist changes can be conditional via --expected-allowlist-revision + --mutation-id. --memory documents headless 1/2/4 GiB in addition to 8/16 GiB. Browser pool update accepts --expected-network JSON for optimistic concurrency (409 stale_network warning).

Vaults: Credential docs/CLI cover passkey fields and add_fields / remove_fields on update; Kernel card / confirm_transaction amount caps rise to 1,000,000 minor units; Link card spec cap is 50,000; recovery, kernel fill, and Link authorize guidance are rewritten.

Proxies: get/update/delete/check accept <id-or-name> with updated help (ambiguity, soft-delete behavior).

Extensive tests cover the new flags and validation paths.

^{Reviewed by Cursor Bugbot for commit 5e6a891. Bugbot is set up for automated code reviews on this repo. Configure here.}

SDK change is documentation-only (BrowserPlaywrightService.Execute comment). Full enumeration of SDK methods vs CLI commands found no coverage gaps (config-registry endpoints are x-cli-skip). Tested: go build ./... (no new commands/flags to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bump kernel-go-sdk to v0.124.0 (80a3ce3). Full SDK/CLI coverage enumeration found no gaps; no new commands or flags needed. Tested: go build ./... (version bump only, no new commands to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…PI key expiry/policy flags - Bump kernel-go-sdk to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 - api-keys create: add --expires-at (APIKeyNewParams.ExpiresAt) and repeatable --policy-statement ACTION=RESOURCE (APIKeyNewParams.Policy) - api-keys get/create: show the key's policy (APIKey.Policy) Tested: api-keys create --expires-at, api-keys create --project-id --policy-statement 'browsers:use=projects/<id>/*', api-keys get (Policy row rendered), mutual-exclusion and parse-error validation, cleanup via api-keys delete. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

SDK change is release metadata only (v0.125.0); full enumeration of api.md methods vs CLI commands found no coverage gaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

socket-security · 2026-10-14T00:02:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/kernel/kernel-go-sdk@v0.126.0 ⏵ v0.129.1-0.20261022224405-b9653c8e152c	⁺¹

View full report

- Bump kernel-go-sdk to e7ab5d320b3e3324e4c73394d4506ed4e5059495 - vaults items invoke <vault> <key> authorize now accepts --params/--spec-file with browser_id and page_url (AuthorizeVaultItemOperationRequestParam.BrowserID, .PageURL); both together or neither; rejected locally for kernel cards - fill fields are now optional (FillVaultItemOperationRequestParam.Fields no longer required); up to 32 bindings when the item requires them - Surface wallet item description (VaultItemWallet.Description) in items get output (json and text) Tested: go test ./...; built binary and checked help text, authorize param validation (browser_id without page_url rejected locally; valid params reach the API), fill without fields reaches the API, vaults items get json against the real API. Live Link authorize was not exercised to avoid initiating real payments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

Bump kernel-go-sdk to v0.126.0 (3296561). The SDK diff since e7ab5d320b3e contains only release metadata; full enumeration found no coverage gaps. Tested: go build ./... (version bump only, no new commands/flags) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ove and passkeys Bump kernel-go-sdk to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd, which adds the passkey credential field type and add_fields/remove_fields on credential vault item updates. `vaults credentials update --spec-file` already passes the spec through CredentialVaultItemSpecUpdateParam, so the new fields work as-is; update the help text, example, and README (definitions are no longer immutable; passkey type rules). Also fix the earlier merge of main, which duplicated the authorize field in vaultOperationParams and broke the build. Take main's authorize handling (--browser-id/--page-url from #298), which supersedes this branch's --params variant, and drop its now-obsolete test. Tested: vaults create; vaults credentials create (text/password fields); vaults credentials update with add_fields (totp + passkey), fields values, and remove_fields -> version 2, ready, fields username/otp/pk; vaults items get; vaults delete. go build ./..., go vet ./cmd, go test ./cmd pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

cursor · 2026-10-15T00:08:54Z

+	for _, statement := range key.Policy.Statements {
+		lines = append(lines, statement.Action+" on "+statement.Resource)
+	}
+	return strings.Join(lines, "\n")


Extra policy statements not displayed

Medium Severity

formatAPIKeyPolicy joins statements with newlines, but PrintTableNoPad only prints the first line of each cell. Human create and get output therefore drop every statement after the first, so a multi-statement key looks narrower than it is.

Additional Locations (2)

cmd/api_keys.go#L384-L385

cmd/api_keys.go#L400-L401

^{Reviewed by Cursor Bugbot for commit 247c1d1. Configure here.}

Update kernel-go-sdk to c01e7cb515705a9e8a82a6334b6b88727f649ced (v0.126.1-0.20261015002534-c01e7cb51570). The SDK change is documentation-only (Kernel card details delivered through fill). No new methods or params. CLI help text now matches it: fill delivers card details for a few minutes, submit checkout promptly, repeated fill is safe, and supported cards without an agentic network token are authorized without a one-time code. Coverage: full enumeration of all api.md methods against CLI commands; no gaps (config-registry endpoints are x-cli-skip). Tested: go build, go vet, go test ./cmd; vaults list against the live API; vaults items invoke --help and vaults cards create --help render the updated text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

- Bump kernel-go-sdk to aaa851dc850d81283fbe553be52a759de4842b39 - Remove expires_at from the LinkCardSpec help and README; the API and SDK no longer accept it (mirrors the help/test change in #299) No new SDK methods or param fields; full enumeration found no gaps (config-registry endpoints are x-cli-skip). Tested: go test ./..., vaults cards create --help (LinkCardSpec has no expires_at), vaults list against the real API Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…o 1000000 - Bump kernel-go-sdk to c5435759242aaa83f6280dcd3506c8dd185752ae - Kernel card spec help: amount is now 1..1000000 minor units ($10,000) - confirm_transaction: accept amounts up to 1000000 minor units, matching ConfirmTransactionVaultItemOperationRequest.amount in the API spec No new SDK methods or param fields; full api.md enumeration found no gaps (config-registry analyses remain x-cli-skip). Tested: go build ./..., go test ./cmd/ (boundary tests moved to 1000000/1000001) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ected-network Bump github.com/kernel/kernel-go-sdk to 4ba1a16b77cf49e77fb755de50602e9ceb96f767. Add `kernel browser-pools update --expected-network <json>` for BrowserPoolUpdateParams.ExpectedNetwork, an atomic optimistic-concurrency precondition on the pool's network configuration. The JSON object is sent raw so explicit empty lists (distinct from omitted lists to the API) are preserved. A 409 stale_network response prints a hint to re-read the pool. Tested against the live API: - browser-pools update --expected-network '{}' --private-host ... (pool with no network) -> success - browser-pools update --expected-network '{}' --size 2 (network changed) -> 409 stale_network, pool unchanged - browser-pools update --expected-network "<network from get -o json>" --clear-private-hosts -> success - browser-pools update --expected-network null -> rejected client-side - go test ./... passes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f240749. Configure here.}

cursor · 2026-10-15T22:19:23Z

+		var apiErr *kernel.Error
+		if expectedNetwork != nil && errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusConflict {
+			pterm.Warning.Println("The pool's network configuration no longer matches --expected-network; nothing was updated. Re-read it with 'kernel browser-pools get <id-or-name> -o json' and retry.")
+		}


409 hint uses placeholder pool id

Medium Severity

The stale_network 409 path prints a pterm.Warning whose retry command uses the placeholder <id-or-name> instead of in.IDOrName, then returns CleanedUpSdkError. Command errors need to be one sentence with the real identifier; wrapping *kernel.Error makes the root handler re-render code: message and drop any hint. Any pool-update 409 is also treated as a stale network match.

^{Triggered by learned rule: CLI errors: single-line; Playwright 409 uses real id}

^{Reviewed by Cursor Bugbot for commit f240749. Configure here.}

Bump github.com/kernel/kernel-go-sdk to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde. The SDK change is doc-only, but it reflects an API behavior change: Link and Kernel cards in recovery_required for issuance may now be deleted and replaced (deleting cancels the known original request). Update the CLI recovery guidance (items get/invoke warnings, cards create/update help, README) so it no longer says such cards must never be deleted or replaced, and so uncertain updates point to delete-and-recreate instead of "must not be retried". Kernel recovery while reporting a merchant transaction still requires support. Coverage: full enumeration of api.md methods against CLI commands found no gaps (config-registry endpoints are x-cli-skip). No params changed. Tested: go build, go vet, go test ./cmd; vaults cards update --help shows the new guidance; vaults list against the live API. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to a7500dba27215b13133ab42299f42720aaefd952. The SDK change only touches browser telemetry response types (new captcha 'media' field, 'binance' captcha provider value); no new methods or params, so no new CLI commands/flags are needed. Full enumeration of api.md methods vs. CLI commands found no coverage gaps (config-registry endpoints are x-cli-skip). Tested: go build ./... (version bump only; no new commands to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…erage

kernel-internal Bot and others added 2 commits October 13, 2026 22:34

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 99b6c2b2751cf65675a01d172e79a0e58a321155~~ CLI: Update Go SDK to 80a3ce316e4f298419b9e14561d12abce778d344 Oct 13, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 80a3ce316e4f298419b9e14561d12abce778d344~~ CLI: Update SDK to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 and add new commands/flags Oct 13, 2026

CLI: Update Go SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b

1ecbae5

SDK change is release metadata only (v0.125.0); full enumeration of api.md methods vs CLI commands found no coverage gaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel-internal Bot changed the title ~~CLI: Update SDK to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 and add new commands/flags~~ CLI: Update SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b and add new commands/flags Oct 14, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b and add new commands/flags~~ CLI: Update SDK to e7ab5d320b3e3324e4c73394d4506ed4e5059495 and add new commands/flags Oct 14, 2026

cursor Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread cmd/vaults_operation_params.go Outdated

kernel-internal Bot changed the title ~~CLI: Update SDK to e7ab5d320b3e3324e4c73394d4506ed4e5059495 and add new commands/flags~~ CLI: Update SDK to 3296561611713cb31143d25f2d7a75beb39a87bb and add new commands/flags Oct 14, 2026

kernel-internal Bot and others added 2 commits October 15, 2026 00:01

Merge main into cli-coverage-update

63a5db2

kernel-internal Bot changed the title ~~CLI: Update SDK to 3296561611713cb31143d25f2d7a75beb39a87bb and add new commands/flags~~ CLI: Update SDK to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

kernel-internal Bot changed the title ~~CLI: Update SDK to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd and add new commands/flags~~ CLI: Update SDK to c01e7cb515705a9e8a82a6334b6b88727f649ced and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread cmd/vaults_help.go

kernel-internal Bot changed the title ~~CLI: Update SDK to c01e7cb515705a9e8a82a6334b6b88727f649ced and add new commands/flags~~ CLI: Update SDK to aaa851dc850d81283fbe553be52a759de4842b39 and add new commands/flags Oct 15, 2026

kernel-internal Bot and others added 3 commits October 15, 2026 20:21

Merge main into cli-coverage-update

643333a

README: raise Kernel card amount cap to 1000000 minor units

394ae96

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel-internal Bot changed the title ~~CLI: Update SDK to aaa851dc850d81283fbe553be52a759de4842b39 and add new commands/flags~~ CLI: Update SDK to c5435759242aaa83f6280dcd3506c8dd185752ae and add new commands/flags Oct 15, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to c5435759242aaa83f6280dcd3506c8dd185752ae and add new commands/flags~~ CLI: Update SDK to 4ba1a16b77cf49e77fb755de50602e9ceb96f767 and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

kernel-internal Bot changed the title ~~CLI: Update SDK to 4ba1a16b77cf49e77fb755de50602e9ceb96f767 and add new commands/flags~~ CLI: Update SDK to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde and add new commands/flags Oct 15, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde and add new commands/flags~~ CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags Oct 15, 2026

Update Go SDK to 126a86281d291ffa25bf281fd172b0663eff09b0 and CLI cov…

07462c3

…erage

kernel-internal Bot changed the title ~~CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags~~ CLI: Update Go SDK to 126a86281d291ffa25bf281fd172b0663eff09b0 Oct 16, 2026

Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a and CLI cov…

909dccf

…erage

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 126a86281d291ffa25bf281fd172b0663eff09b0~~ CLI: Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a Oct 16, 2026

Update Go SDK to 150da88e9d59ce8e166b3fb34bb2d64f49155eb4 and CLI cov…

9f9c5e0

…erage

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 721b8dc53e92d9b7326f30174d71fe5f15c0f21a~~ CLI: Update Go SDK to 150da88e9d59ce8e166b3fb34bb2d64f49155eb4 Oct 20, 2026

Update Go SDK to 0f4d858cac3654f1608bac126d7f18d10a1a869d and CLI cov…

1cfbf47

…erage

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 150da88e9d59ce8e166b3fb34bb2d64f49155eb4~~ CLI: Update Go SDK to 0f4d858cac3654f1608bac126d7f18d10a1a869d Oct 21, 2026

bmsaadat mentioned this pull request Oct 21, 2026

Add --timezone and --locale to browsers create and update #302

Merged

Update Go SDK to b9653c8e152c2469fcf4d036937ae0ad2c75b9fa and CLI cov…

5e6a891

…erage

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 0f4d858cac3654f1608bac126d7f18d10a1a869d~~ CLI: Update Go SDK to b9653c8e152c2469fcf4d036937ae0ad2c75b9fa Oct 22, 2026

Navigation Menu

Repository navigation

CLI: Update Go SDK to b9653c8e152c2469fcf4d036937ae0ad2c75b9fa - #296

CLI: Update Go SDK to b9653c8e152c2469fcf4d036937ae0ad2c75b9fa#296
kernel-internal[bot] wants to merge 21 commits into
mainfrom
cli-coverage-update

kernel-internal Bot commented Oct 13, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot Oct 15, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Oct 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

kernel-internal Bot commented Oct 13, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Coverage

CLI Coverage Update Report

SDK update

Coverage review

Gap analysis

Missing commands

Missing flags

Help text review

Intentional exclusions

Validation

Validation

Uh oh!

socket-security Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Oct 15, 2026

Choose a reason for hiding this comment

Extra policy statements not displayed

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 15, 2026

Choose a reason for hiding this comment

409 hint uses placeholder pool id

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

kernel-internal Bot commented Oct 13, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Oct 14, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading