CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags by kernel-internal[bot] · Pull Request #296 · kernel/cli

kernel-internal · 2026-10-13T22:34:54Z

This PR updates the Go SDK to a7500dba27215b13133ab42299f42720aaefd952 and adds CLI commands/flags for new SDK methods.

SDK Update

Updated kernel-go-sdk to a7500dba27215b13133ab42299f42720aaefd952 (v0.126.1-0.20261015232057-a7500dba2721).
The latest bump (a7500db) changes only browser telemetry response types: captcha events gain a media field (image/video), and binance is a new captcha_provider value. Text captchas a site draws itself are classified as other. No methods or params changed, and the CLI doesn't enumerate captcha providers, so no CLI changes were needed beyond go.mod/go.sum.
Previous bump (c29cc0a) changes only doc comments, but they describe an API behavior change: Link and Kernel cards in recovery_required for issuance can now be deleted and replaced with a new card. Deleting cancels the original request when its ID is known. Kernel recovery while reporting a merchant transaction still needs support. The CLI's recovery guidance (kernelSupportGuidance, which feeds the items get/items invoke warnings and card help), the cards create/update help, and the README used to say these items must never be deleted or replaced, and that an uncertain update "must not be retried". They now point to user-confirmed delete-and-recreate. No code paths changed: items delete never blocked recovery items.
Earlier bump (4ba1a16) added BrowserPoolUpdateParams.ExpectedNetwork, an atomic optimistic-concurrency precondition for pool network updates. If the saved network differs, the API rejects the whole update with 409 stale_network.
Earlier bump (c5435759) raised the Kernel card amount cap from 50000 to 1000000 minor units ($500 to $10,000). KernelCardSpec help, confirm_transaction validation/help, and the README now use 1..1000000 / 0..1000000. Link limits are unchanged.
Earlier bump (aaa851d) removed ExpiresAt from the Link card spec. The LinkCardSpec help and README no longer list expires_at. These are the same hunks as Remove expires_at from the Link card spec help #299, plus the README line Remove expires_at from the Link card spec help #299 missed.
Earlier bumps on this branch: c01e7cb (refreshed Kernel card fill guidance) and 5fcd5cb (credential passkey type, add_fields/remove_fields).

Coverage Analysis

This PR was generated by performing a full enumeration of SDK methods and CLI commands. All 175 methods in api.md have a CLI command, except the x-cli-skip config-registry endpoints. client.Search.Contents.Fetch is covered by kernel search contents, which makes a raw HTTP call.

New Commands

None. No SDK methods were added.

New Flags

--expected-network <json> on kernel browser-pools update for BrowserPoolUpdateParams.ExpectedNetwork. It takes the pool's browser_pool_config.network object from browser-pools get -o json, or '{}' when the pool has no network config. The JSON is sent raw so explicit empty lists, which the API treats differently from omitted ones, are kept. A 409 prints a hint to re-read the pool. The README is updated.
Changed earlier: the Kernel card amount cap is 1000000 in help, README, and confirm_transaction validation.
Removed earlier: expires_at from the documented LinkCardSpec.
kernel vaults credentials update --spec-file accepts add_fields / remove_fields, and the passkey field type is documented.
Already on this branch from earlier: kernel api-keys create --expires-at and --policy-statement. fill params treat fields as optional. VaultItemWallet.Description is shown in item output.

Merge fix (earlier)

The earlier merge of main left vaultOperationParams with a duplicate Authorize field. I took main's authorize handling from Support Link Pay Token checkout in vault card commands #298 and removed the obsolete authorize --params test.

Testing

go build ./..., go vet ./cmd, and go test ./... pass. New unit tests cover the expected_network wire encoding (including {} and explicit []) and client-side rejection of null, arrays, and invalid JSON.
Latest update (a7500db): version bump only. go build ./... passes, and the full api.md enumeration found no new gaps. There were no new commands or flags to smoke test.
Previous update (c29cc0a): go build, go vet, go test ./cmd pass. vaults cards update --help shows the new guidance, and vaults list works against the real API. A real card in recovery_required can't be produced on demand, so the recovery path itself was not exercised live.
Earlier update (4ba1a16), against the real API (temporary pool, deleted afterwards):
- browser-pools update --expected-network '{}' --private-host '*.example.ts.net' on a pool with no network config: success.
- browser-pools update --expected-network '{}' --size 2 after the network changed: 409 stale_network, and the pool was not updated.
- browser-pools update --expected-network '<network from get -o json>' --clear-private-hosts: success, and the network was cleared.
- --expected-network null: rejected client-side.
Previous updates: confirm_transaction boundary tests (1000000 accepted, 1000001 rejected); vaults cards create --help; credentials create/update with add_fields/remove_fields/passkey against the real API.

Known pre-existing gaps (not in this SDK diff, left for follow-up)

The CLI has no flags for BrowserUpdateParams.Telemetry.Export/Storage or BrowserPool{New,Update}Params.Telemetry.Export/Storage.
Search.* and Browsers.Curl are reached through raw HTTP calls rather than the typed SDK methods.
OfConfirmTransaction and OfRestartVerification are typed in the SDK, but the CLI still sends raw or cast bodies for them.

Triggered by: kernel/kernel-go-sdk@a7500db
Reviewer: @kernel-internal[bot]

🤖 Generated with Claude Code

Note

Medium Risk
Changes affect payment limits, recovery workflows, and pool network updates with concurrency checks; API key policy parsing is security-sensitive but validated client-side before create.

Overview
Bumps kernel-go-sdk and wires new API surface into the CLI plus refreshed vault/card/credential documentation.

API keys: api-keys create gains --expires-at (RFC 3339, mutually exclusive with --days-to-expire) and repeatable --policy-statement ACTION=RESOURCE for scoped allow policies; create/get tables show policy when present.

Browser pools: browser-pools update adds --expected-network JSON for optimistic concurrency on network config; mismatches return 409 stale_network with a re-read hint. JSON is sent via extra fields so empty lists are preserved.

Vaults: Kernel card amount and confirm_transaction amount validation move to 1..1_000_000 minor units. Help/README describe credential passkey, add_fields / remove_fields on update, revised Kernel fill timing (short-lived details, safe refills), and recovery guidance that allows user-confirmed delete-and-recreate for some Link/Kernel/AgentCard cases instead of “never delete/retry.” Link expires_at is dropped from documented card specs.

^{Reviewed by Cursor Bugbot for commit 3343650. Bugbot is set up for automated code reviews on this repo. Configure here.}

SDK change is documentation-only (BrowserPlaywrightService.Execute comment). Full enumeration of SDK methods vs CLI commands found no coverage gaps (config-registry endpoints are x-cli-skip). Tested: go build ./... (no new commands/flags to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bump kernel-go-sdk to v0.124.0 (80a3ce3). Full SDK/CLI coverage enumeration found no gaps; no new commands or flags needed. Tested: go build ./... (version bump only, no new commands to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…PI key expiry/policy flags - Bump kernel-go-sdk to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 - api-keys create: add --expires-at (APIKeyNewParams.ExpiresAt) and repeatable --policy-statement ACTION=RESOURCE (APIKeyNewParams.Policy) - api-keys get/create: show the key's policy (APIKey.Policy) Tested: api-keys create --expires-at, api-keys create --project-id --policy-statement 'browsers:use=projects/<id>/*', api-keys get (Policy row rendered), mutual-exclusion and parse-error validation, cleanup via api-keys delete. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

SDK change is release metadata only (v0.125.0); full enumeration of api.md methods vs CLI commands found no coverage gaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

socket-security · 2026-10-14T00:02:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/kernel/kernel-go-sdk@v0.126.0 ⏵ v0.126.1-0.20261015232057-a7500dba2721	⁺¹

View full report

- Bump kernel-go-sdk to e7ab5d320b3e3324e4c73394d4506ed4e5059495 - vaults items invoke <vault> <key> authorize now accepts --params/--spec-file with browser_id and page_url (AuthorizeVaultItemOperationRequestParam.BrowserID, .PageURL); both together or neither; rejected locally for kernel cards - fill fields are now optional (FillVaultItemOperationRequestParam.Fields no longer required); up to 32 bindings when the item requires them - Surface wallet item description (VaultItemWallet.Description) in items get output (json and text) Tested: go test ./...; built binary and checked help text, authorize param validation (browser_id without page_url rejected locally; valid params reach the API), fill without fields reaches the API, vaults items get json against the real API. Live Link authorize was not exercised to avoid initiating real payments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

Bump kernel-go-sdk to v0.126.0 (3296561). The SDK diff since e7ab5d320b3e contains only release metadata; full enumeration found no coverage gaps. Tested: go build ./... (version bump only, no new commands/flags) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ove and passkeys Bump kernel-go-sdk to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd, which adds the passkey credential field type and add_fields/remove_fields on credential vault item updates. `vaults credentials update --spec-file` already passes the spec through CredentialVaultItemSpecUpdateParam, so the new fields work as-is; update the help text, example, and README (definitions are no longer immutable; passkey type rules). Also fix the earlier merge of main, which duplicated the authorize field in vaultOperationParams and broke the build. Take main's authorize handling (--browser-id/--page-url from #298), which supersedes this branch's --params variant, and drop its now-obsolete test. Tested: vaults create; vaults credentials create (text/password fields); vaults credentials update with add_fields (totp + passkey), fields values, and remove_fields -> version 2, ready, fields username/otp/pk; vaults items get; vaults delete. go build ./..., go vet ./cmd, go test ./cmd pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

cursor · 2026-10-15T00:08:54Z

+	for _, statement := range key.Policy.Statements {
+		lines = append(lines, statement.Action+" on "+statement.Resource)
+	}
+	return strings.Join(lines, "\n")


Extra policy statements not displayed

Medium Severity

formatAPIKeyPolicy joins statements with newlines, but PrintTableNoPad only prints the first line of each cell. Human create and get output therefore drop every statement after the first, so a multi-statement key looks narrower than it is.

Additional Locations (2)

cmd/api_keys.go#L384-L385

cmd/api_keys.go#L400-L401

^{Reviewed by Cursor Bugbot for commit 247c1d1. Configure here.}

Update kernel-go-sdk to c01e7cb515705a9e8a82a6334b6b88727f649ced (v0.126.1-0.20261015002534-c01e7cb51570). The SDK change is documentation-only (Kernel card details delivered through fill). No new methods or params. CLI help text now matches it: fill delivers card details for a few minutes, submit checkout promptly, repeated fill is safe, and supported cards without an agentic network token are authorized without a one-time code. Coverage: full enumeration of all api.md methods against CLI commands; no gaps (config-registry endpoints are x-cli-skip). Tested: go build, go vet, go test ./cmd; vaults list against the live API; vaults items invoke --help and vaults cards create --help render the updated text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

- Bump kernel-go-sdk to aaa851dc850d81283fbe553be52a759de4842b39 - Remove expires_at from the LinkCardSpec help and README; the API and SDK no longer accept it (mirrors the help/test change in #299) No new SDK methods or param fields; full enumeration found no gaps (config-registry endpoints are x-cli-skip). Tested: go test ./..., vaults cards create --help (LinkCardSpec has no expires_at), vaults list against the real API Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…o 1000000 - Bump kernel-go-sdk to c5435759242aaa83f6280dcd3506c8dd185752ae - Kernel card spec help: amount is now 1..1000000 minor units ($10,000) - confirm_transaction: accept amounts up to 1000000 minor units, matching ConfirmTransactionVaultItemOperationRequest.amount in the API spec No new SDK methods or param fields; full api.md enumeration found no gaps (config-registry analyses remain x-cli-skip). Tested: go build ./..., go test ./cmd/ (boundary tests moved to 1000000/1000001) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ected-network Bump github.com/kernel/kernel-go-sdk to 4ba1a16b77cf49e77fb755de50602e9ceb96f767. Add `kernel browser-pools update --expected-network <json>` for BrowserPoolUpdateParams.ExpectedNetwork, an atomic optimistic-concurrency precondition on the pool's network configuration. The JSON object is sent raw so explicit empty lists (distinct from omitted lists to the API) are preserved. A 409 stale_network response prints a hint to re-read the pool. Tested against the live API: - browser-pools update --expected-network '{}' --private-host ... (pool with no network) -> success - browser-pools update --expected-network '{}' --size 2 (network changed) -> 409 stale_network, pool unchanged - browser-pools update --expected-network "<network from get -o json>" --clear-private-hosts -> success - browser-pools update --expected-network null -> rejected client-side - go test ./... passes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f240749. Configure here.}

cursor · 2026-10-15T22:19:23Z

+		var apiErr *kernel.Error
+		if expectedNetwork != nil && errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusConflict {
+			pterm.Warning.Println("The pool's network configuration no longer matches --expected-network; nothing was updated. Re-read it with 'kernel browser-pools get <id-or-name> -o json' and retry.")
+		}


409 hint uses placeholder pool id

Medium Severity

The stale_network 409 path prints a pterm.Warning whose retry command uses the placeholder <id-or-name> instead of in.IDOrName, then returns CleanedUpSdkError. Command errors need to be one sentence with the real identifier; wrapping *kernel.Error makes the root handler re-render code: message and drop any hint. Any pool-update 409 is also treated as a stale network match.

^{Triggered by learned rule: CLI errors: single-line; Playwright 409 uses real id}

^{Reviewed by Cursor Bugbot for commit f240749. Configure here.}

Bump github.com/kernel/kernel-go-sdk to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde. The SDK change is doc-only, but it reflects an API behavior change: Link and Kernel cards in recovery_required for issuance may now be deleted and replaced (deleting cancels the known original request). Update the CLI recovery guidance (items get/invoke warnings, cards create/update help, README) so it no longer says such cards must never be deleted or replaced, and so uncertain updates point to delete-and-recreate instead of "must not be retried". Kernel recovery while reporting a merchant transaction still requires support. Coverage: full enumeration of api.md methods against CLI commands found no gaps (config-registry endpoints are x-cli-skip). No params changed. Tested: go build, go vet, go test ./cmd; vaults cards update --help shows the new guidance; vaults list against the live API. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bumps github.com/kernel/kernel-go-sdk to a7500dba27215b13133ab42299f42720aaefd952. The SDK change only touches browser telemetry response types (new captcha 'media' field, 'binance' captcha provider value); no new methods or params, so no new CLI commands/flags are needed. Full enumeration of api.md methods vs. CLI commands found no coverage gaps (config-registry endpoints are x-cli-skip). Tested: go build ./... (version bump only; no new commands to smoke test) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel-internal Bot and others added 2 commits October 13, 2026 22:34

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 99b6c2b2751cf65675a01d172e79a0e58a321155~~ CLI: Update Go SDK to 80a3ce316e4f298419b9e14561d12abce778d344 Oct 13, 2026

kernel-internal Bot changed the title ~~CLI: Update Go SDK to 80a3ce316e4f298419b9e14561d12abce778d344~~ CLI: Update SDK to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 and add new commands/flags Oct 13, 2026

CLI: Update Go SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b

1ecbae5

SDK change is release metadata only (v0.125.0); full enumeration of api.md methods vs CLI commands found no coverage gaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel-internal Bot changed the title ~~CLI: Update SDK to 4ecfaa017984165d5c22b033f5f9a8787e4b5d54 and add new commands/flags~~ CLI: Update SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b and add new commands/flags Oct 14, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to 7aac51875bc3041bcc5975f6eaddff69de7df30b and add new commands/flags~~ CLI: Update SDK to e7ab5d320b3e3324e4c73394d4506ed4e5059495 and add new commands/flags Oct 14, 2026

cursor Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread cmd/vaults_operation_params.go Outdated

kernel-internal Bot changed the title ~~CLI: Update SDK to e7ab5d320b3e3324e4c73394d4506ed4e5059495 and add new commands/flags~~ CLI: Update SDK to 3296561611713cb31143d25f2d7a75beb39a87bb and add new commands/flags Oct 14, 2026

kernel-internal Bot and others added 2 commits October 15, 2026 00:01

Merge main into cli-coverage-update

63a5db2

kernel-internal Bot changed the title ~~CLI: Update SDK to 3296561611713cb31143d25f2d7a75beb39a87bb and add new commands/flags~~ CLI: Update SDK to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

kernel-internal Bot changed the title ~~CLI: Update SDK to 5fcd5cb3d70a57e4eaa55cf9a4e31d8826a0d4bd and add new commands/flags~~ CLI: Update SDK to c01e7cb515705a9e8a82a6334b6b88727f649ced and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread cmd/vaults_help.go

kernel-internal Bot changed the title ~~CLI: Update SDK to c01e7cb515705a9e8a82a6334b6b88727f649ced and add new commands/flags~~ CLI: Update SDK to aaa851dc850d81283fbe553be52a759de4842b39 and add new commands/flags Oct 15, 2026

kernel-internal Bot and others added 3 commits October 15, 2026 20:21

Merge main into cli-coverage-update

643333a

README: raise Kernel card amount cap to 1000000 minor units

394ae96

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel-internal Bot changed the title ~~CLI: Update SDK to aaa851dc850d81283fbe553be52a759de4842b39 and add new commands/flags~~ CLI: Update SDK to c5435759242aaa83f6280dcd3506c8dd185752ae and add new commands/flags Oct 15, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to c5435759242aaa83f6280dcd3506c8dd185752ae and add new commands/flags~~ CLI: Update SDK to 4ba1a16b77cf49e77fb755de50602e9ceb96f767 and add new commands/flags Oct 15, 2026

cursor Bot reviewed Oct 15, 2026

View reviewed changes

kernel-internal Bot changed the title ~~CLI: Update SDK to 4ba1a16b77cf49e77fb755de50602e9ceb96f767 and add new commands/flags~~ CLI: Update SDK to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde and add new commands/flags Oct 15, 2026

kernel-internal Bot changed the title ~~CLI: Update SDK to c29cc0a2acc90a2a8cb85009e0b675795f9fbbde and add new commands/flags~~ CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags Oct 15, 2026

Navigation Menu

Repository navigation

CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags - #296

CLI: Update SDK to a7500dba27215b13133ab42299f42720aaefd952 and add new commands/flags#296
kernel-internal[bot] wants to merge 16 commits into
mainfrom
cli-coverage-update

kernel-internal Bot commented Oct 13, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot Oct 15, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Oct 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

kernel-internal Bot commented Oct 13, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SDK Update

Coverage Analysis

New Commands

New Flags

Merge fix (earlier)

Testing

Known pre-existing gaps (not in this SDK diff, left for follow-up)

Uh oh!

socket-security Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Oct 15, 2026

Choose a reason for hiding this comment

Extra policy statements not displayed

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 15, 2026

Choose a reason for hiding this comment

409 hint uses placeholder pool id

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

kernel-internal Bot commented Oct 13, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Oct 14, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading