CLI: Update SDK to aee0b02b9b0bdb2f84172ee9b568696dcd8fa482 and add new commands/flags - #264
Open
kernel-internal[bot] wants to merge 17 commits into
Open
kernel-internal[bot] wants to merge 17 commits into
kernel-internal[bot] wants to merge 17 commits into
Conversation
Bumps the Go SDK from v0.105.1-0.20260916183112-dab5c0714192 to v0.107.0
(commit 6c9df7b).
The SDK surface is unchanged across this range: the previously pinned
pseudo-version already contained every feature commit in the 0.106.0 and
0.107.0 releases (persistent browser REPL, browser update start_url, config
registry, AgentCard preparation contracts, Link spend request errors). Only
release metadata differs, so no new commands or flags were required.
Coverage analysis: full enumeration of all 165 SDK methods in api.md against
the CLI command tree found no gaps. The six client.ConfigRegistry.* methods
are marked x-cli-skip in openapi.yaml and are correctly excluded. Param
fields without a dedicated flag were each verified as intentional:
- AuditLog{List,ExportChunk}Params.SearchUserID -> covered by --user-id
- AuditLogListParams.PageToken -> handled internally by ListAutoPaging
- AuthConnectionLoginParams.BrowserTelemetry -> deprecated, superseded by
browser.telemetry, which --telemetry covers
- BrowserCurlParams.ResponseEncoding -> `browsers curl` streams raw bytes
through its own HTTP client rather than the SDK method
Tested: go build ./..., go vet ./..., go test ./... (all 9 packages pass),
plus live API smoke tests of `browsers list`, `browsers create`,
`browsers repl` (verified top-level bindings persist across calls under a
stable REPL ID), `browsers update --start-url`, and `browsers delete`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Updates github.com/kernel/kernel-go-sdk from v0.107.0 to
v0.107.1-0.20260917184535-51d7fb82550d (commit 51d7fb8).
The upstream commit ("chore(stlc): seal custom-code tracking files")
contains no API surface changes -- the api.md/Go source diff between
v0.107.0 and 51d7fb8 is empty.
Coverage analysis: full enumeration of all 165 methods in api.md against
the CLI command tree (215 commands). All 159 non-skipped methods have a
corresponding CLI command; the 6 config-registry methods are marked
x-cli-skip: true in openapi.yaml. All params struct fields map to
existing flags, positional args, or are pagination internals handled by
the auto-pagers.
No new commands or flags were needed.
Tested: go build ./..., go vet ./..., go test ./... (all pass),
kernel browsers list, kernel profiles list against the live API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Updates github.com/kernel/kernel-go-sdk from
v0.107.1-0.20260917184535-51d7fb82550d to v0.108.0.
The only difference between the two module versions is the
internal/version.go version constant -- api.md and every public Go
source file are byte-identical, so there are no new API methods,
params, or fields to expose.
Coverage analysis: full enumeration of all 165 SDK methods in api.md
against all 176 CLI leaf commands found no gaps. 6 methods
(ConfigRegistry.{List,Lookup,Resolve} and
ConfigRegistry.Analyses.{Get,List,Cancel}) are marked x-cli-skip in
openapi.yaml and are intentionally absent. The remaining 159 all have
CLI commands. An automated SDK-param-field vs CLI-flag comparison
surfaced only naming false positives (e.g. proxy -> --proxy-id/--proxy-name,
tags -> --tag, timeout_seconds -> --timeout, hold_keys -> --hold-key) and
fields exposed as positional args; all were verified covered.
Tested: go build ./..., go vet ./... (clean), go test ./... (all pass),
and smoke-tested `kernel browsers list` and `kernel app list` against
the live API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Updates kernel-go-sdk to 6367486e6e06cdc3d9dc13c107dddca490e9b9bc. That SDK change adds two response fields to OrgLimits: concurrent_sessions_used and concurrent_sessions_available. Surface both as rows in `kernel org limits get`. A null here means usage could not be read rather than "unlimited", so these render as "unknown" instead of reusing formatProjectLimitValue. A full enumeration of the 165 methods in api.md found no missing commands; the 6 config-registry methods are x-cli-skip. Param-field audit found no missing flags: AuditLogListParams.PageToken is consumed by the SDK auto-pager, AuthConnectionLoginParams.BrowserTelemetry is deprecated in favor of browser.telemetry (already wired), and BrowserCurlParams.ResponseEncoding does not apply because `browsers curl` streams raw bytes over the browser HTTP client rather than calling Browsers.Curl. Tested: `kernel org limits get` and `-o json` against the live API (1118 used + 882 available = 2000 max); full `go test ./...` passes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bumps kernel-go-sdk to 3038f83eb3f7cc6a59059a0a04bdb111300ea77c, which preserves credential field order: CredentialVaultItemSpec.Fields and CredentialVaultItemSpecInputParam.Fields changed from a map keyed by name to an ordered array, and each definition now carries a stable `name`. - vaults_output.go: project spec.fields as an array (name, type, required, sensitive) instead of a keyed object, and look definitions up by name when deciding which non-sensitive values stay visible. - vaults_credentials.go: document the ordered array and the name pattern, update the create example, note that update specs stay keyed by name, reject specs still using the object form with actionable guidance, and require every create field to carry a name. Error text never echoes values. - README.md: same shape and ordering guidance. - Tests: fixtures moved to the array shape; added coverage for field order reaching the API unchanged, the keyed-form error, and the missing-name error. A full enumeration of api.md against the CLI command tree found no missing commands. All config-registry and auth exchange endpoints are x-cli-skip. Tested against the live API: vaults credentials create with out-of-alphabetical field order (order preserved in the request and in get/list output), vaults items get/list, vaults credentials update (keyed form, non-sensitive text/email values still surfaced, sensitive omitted), vaults items invoke fill by field name, and both new validation errors. Test vault, item, and browser deleted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Updates github.com/kernel/kernel-go-sdk to
v0.108.1-0.20260917213155-5cfceddfb1ea (5cfcedd).
The SDK change ("Accept opaque AgentCard vaulted card IDs") revises the
card_id contract on CardVaultItemSpecAgentcard: the value is an opaque ID
returned by AgentCard and must be passed through unchanged, without
assuming a prefix or format. The `vaults cards create|update` help text
still advertised a `vc_...` shape, so it is updated to match.
The CLI already forwards card_id verbatim inside the --spec JSON (there is
no --card-id flag), so no behavior change was needed; a regression test now
pins that prefixed, unprefixed and punctuated IDs all round-trip unchanged.
A full enumeration of all 165 SDK methods in api.md against the CLI command
tree found no missing commands. The six client.ConfigRegistry.* methods are
marked x-cli-skip in openapi.yaml and are intentionally absent. The
AgentCard and Link card spec field sets in the help text were verified
complete against the SDK param structs. No new params or fields were added
by this SDK bump, so no new flags were required.
Tested: go build ./..., go vet ./..., go test ./... (all pass);
vaults cards create --help (help renders on one line);
against production API: auth status, app list, vaults list,
vaults items list agentcard-vault, vaults items get agentcard-vault.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Updates github.com/kernel/kernel-go-sdk from v0.108.1-0.20260917213155-5cfceddfb1ea to the v0.109.0 release (5c91a27). Coverage analysis: api.md is byte-identical across this bump, so no API methods, params or fields were added and no new commands or flags are required. The only source changes relative to the previously pinned pseudo-version are the release version stamp and a new ConfigRegistryAnalysisService.WaitForResult convenience helper. All six /config-registry endpoints are marked x-cli-skip in openapi.yaml, so that helper is intentionally out of CLI scope. A full enumeration of all 165 api.md methods against the CLI command tree found no gaps. The six methods that do not match cmd/ by name are covered through the SDK's *Streaming variants (Deployments.FollowStreaming, Invocations.FollowStreaming, Browsers.Logs.StreamStreaming, Browsers.Telemetry.StreamStreaming, Browsers.Fs.Watch.EventsStreaming, Browsers.Process.StdoutStreamStreaming). The OrgLimits concurrency fields and the opaque AgentCard card_id help text, both landed earlier on this branch, were re-verified against the release. Tested: go build ./..., go vet ./..., go test ./... (all pass); against the production API: org limits get (both concurrency fields render), vaults list, vaults cards create --help. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bumps kernel-go-sdk from v0.109.0 to v0.109.1-0.20260918194421-c4dc2a28cd2b, which adds an optional `label` to CredentialVaultFieldDefinition and CredentialVaultFieldInputParam. `label` is non-secret display metadata for the hosted collection form. It already reached the API because credential specs are passed through from --spec-file, but the display-safe output projection dropped it: the spec.fields allowlist in printVaultItem only permitted name/type/required/ sensitive, so every read silently discarded a label the API returned. Add it to the allowlist and document it in the command help and README. A full enumeration of api.md (165 methods) against the CLI command tree (176 commands) found no missing commands. The six config-registry endpoints are marked x-cli-skip in openapi.yaml and remain unexposed; Invocations.Follow and Deployments.Follow are covered by the streaming paths in logs/invoke/deploy logs. Tested against the live API: vaults credentials create with labelled text and password fields round-trips `label` to the API and back, and vaults items get/list both render it. Verified the pre-fix binary stripped `label` from the same responses. Sensitive values stay omitted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The credential field `label` support landed here against the pre-release commit c4dc2a2 (pseudo-version v0.109.1-0.20260918194421-c4dc2a28cd2b). That change is now published as the tagged v0.110.0 release, so pin the release instead of the pseudo-version; the SDK source is identical. Also guards the credentials help text with a steering assertion so the `label` documentation is not silently dropped by a later edit. A full enumeration of all 165 api.md methods against the CLI command tree found no missing commands; the 6 config-registry methods are x-cli-skip. Tested against the live API: vaults credentials create with labelled text and password fields round-trips `label` through create, items get, and items list; the test vault was deleted afterwards. go build ./... and go test ./... pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bumps kernel-go-sdk from v0.110.0 to
v0.110.1-0.20260918232759-6e379e6df7b9. The only change is in
browsertelemetry.go: the proxy_error event's code enum gains
origin_response_incomplete, restricted_route_unavailable, and unknown,
and BrowserProxyErrorEventData gains raw_code (the sanitized
X-Kernel-Proxy-Error header, present only when code is unknown).
No CLI change is needed for that field. Unlike the credential-label case,
telemetry output has no display allowlist: `browsers telemetry events`
and `telemetry stream` render the Seq/Time/Category/Type table from the
event envelope and emit the event body verbatim under `-o json`, so
raw_code and the new codes flow through on their own.
A full enumeration of api.md (165 methods) against the CLI command tree
(175 commands) found no missing commands or flags. The six
config-registry endpoints are marked x-cli-skip in openapi.yaml and
remain unexposed, as does POST /auth/connections/{id}/exchange, which
the SDK does not surface; the other 159 methods all map to a command.
No request param struct changed since v0.110.0, so no new flags.
Also drops a stale assertion in TestCredentialHelpSteering. The branch
and main both added credential field labels; main's wording of the help
text won the merge, but the branch's assertion on its own earlier
phrasing ("definitions accept name, label, required, sensitive")
survived and failed. The neighboring assertion on "optional non-secret
human-readable label" already covers the same guidance.
Tested against the live API: browsers create --telemetry network,page;
browsers curl; browsers telemetry events (table and -o json);
browsers delete. Full go test ./... passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Bumps kernel-go-sdk to v0.110.1-0.20260921155736-dd9a4a4e3d3a, which adds
AgentcardPreparedProcessorAdyen and reframes prepare_checkout from
"tokenization" to general "checkout" preparation.
- cmd/vaults_prepare_checkout.go: add adyen to vaultCheckoutProcessors so
`checkout.psp: "adyen"` passes CLI validation instead of being rejected
- cmd/vaults_commands.go, README.md: document adyen, its production/sandbox
environment pairing, the fresh-card Sessions restriction (public dummy card
fields, not vault aliases), and that device approval / browser Authorised
responses are not capture or fulfillment evidence
Full enumeration of api.md methods against CLI commands found no missing
commands; the six /config-registry methods and auth/connections exchange are
marked x-cli-skip in openapi.yaml. No new param fields in this SDK bump.
Tested: `go build ./...` and `go test ./...` pass; against the live API,
`vaults items invoke <vault> <item> prepare_checkout --params
'{"checkout":{...,"psp":"adyen"}}'` now passes CLI validation and reaches the
API, while `"psp":"stripe"` is still rejected with the updated processor list.
Did not arm a real Adyen preparation, since preparations are single-use and
would irreversibly consume a live AgentCard card.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates github.com/kernel/kernel-go-sdk to
v0.110.1-0.20260921185747-68c51002947b (68c5100).
The SDK delta from dd9a4a4 touches only authconnection.go: documentation
rewording on ManagedAuth.CanReauth / CanReauthReason plus one new enum
value, ManagedAuthCanReauthReasonOptimisticTotpAttempt
("optimistic_totp_attempt"). No new methods, resources, or param fields.
The CLI renders CanReauthReason as an opaque string in both the auth
connections list and get views, so the new value surfaces with no code
change.
Coverage analysis: full enumeration of all 165 methods in the SDK api.md
against the 176 commands in the CLI command tree found no missing
commands. The 6 ConfigRegistry methods are marked x-cli-skip in
openapi.yaml and are correctly absent.
Tested against the production API:
- kernel status
- kernel auth context
- kernel auth connections list --limit 3 (table and -o json)
- kernel auth connections get <id> (Can Reauth / Can Reauth Reason render)
- go build ./..., go vet ./..., go test ./... all pass
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates kernel-go-sdk to v0.110.1-0.20260921192205-ca8d4655a0dc, which adds ManagedAuthTimelineEvent.CompletedAt: the stable timestamp for when a login/reauth attempt first reached a terminal status. Full enumeration of api.md methods against cmd/ found no missing commands or param flags. The only SDK change was this response field, so `kernel auth connections timeline` now renders a Completed column alongside Timestamp. It dashes out for in-progress attempts, health checks, and historical attempts with no recorded completion time. Tested: kernel auth connections timeline (table + --output json, with and without --type/--page/--per-page) against the staging API; unit test extended to cover a populated completed_at. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
Updates kernel-go-sdk to aee0b02b9b0bdb2f84172ee9b568696dcd8fa482, which adds AuthConnectionLoginParams.SkillMode: a per-login control over whether the flow reads and writes learned domain skills. Automatic reauths inherit the selected mode, so exposing it on `kernel auth connections login` is the only way to opt a connection out of skill learning from the CLI. The value is validated locally against enabled/disabled so a typo fails before a login flow is started, and omitting the flag leaves the field unset so the API keeps its default of enabled. A full enumeration of api.md methods against the CLI's commands found no other gaps: every SDK method has a command except the config-registry and auth exchange endpoints marked x-cli-skip, and the only uncovered params fields are deprecated (login browser_telemetry), handled internally (audit log page_token via ListAutoPaging), or not applicable (curl response_encoding, since the CLI streams raw bytes through the browser HTTP client). Tested: auth connections login --skill-mode disabled, --skill-mode enabled, and an invalid value against the real API, plus unit tests for set/omitted/invalid. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kernel-internal
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates the Go SDK to aee0b02b9b0bdb2f84172ee9b568696dcd8fa482 and adds CLI commands/flags for new SDK methods.
SDK Update
Coverage Analysis
This PR was generated by performing a full enumeration of SDK methods and CLI commands.
All 165 methods in
api.mdhave CLI coverage. The only uncovered endpoints are the ones markedx-cli-skip: trueinopenapi.yaml(the/config-registry/*endpoints andPOST /auth/connections/{id}/exchange). Every top-level*Paramsfield maps to a CLI flag except three that are intentionally not flags:AuthConnectionLoginParams.BrowserTelemetry— deprecated; the CLI sendsbrowser.telemetry.AuditLogListParams.PageToken— handled internally byListAutoPaging.BrowserCurlParams.ResponseEncoding— not applicable;kernel browsers curlstreams raw bytes through the browser HTTP client rather than the JSON curl endpoint.New Commands
None — no new SDK methods in this update.
New Flags
--skill-modeonkernel auth connections loginforAuthConnectionLoginParams.SkillMode. Controls whether the login reads and writes learned domain skills (enabled|disabled); automatic reauths inherit the selected mode. Omitting the flag leaves the field unset so the API keeps its default ofenabled, and an invalid value is rejected locally before a flow is started.Testing
Smoke tested against the real API (managed auth connection created, exercised, and deleted):
kernel auth connections login <id> --skill-mode disabled— flow startedkernel auth connections login <id> --skill-mode enabled— flow startedkernel auth connections login <id> --skill-mode bogus— rejected locally with a clear errorUnit tests added for the set, omitted, and invalid cases;
go build ./...andgo test ./...pass.Triggered by: kernel/kernel-go-sdk@aee0b02
Reviewer: @kernel-internal[bot]
Note
Medium Risk
Credential create JSON is a breaking shape change for scripts still using keyed
fields; checkout and org usage changes touch payment and capacity-sensitive flows.Overview
Bumps kernel-go-sdk and wires several new API shapes into the CLI and docs.
Managed auth:
auth connections logingains--skill-mode(enabled/disabled) with local validation; omitting the flag leaves the API default. The timeline table adds a Completed column fromcompleted_at.Org limits:
org limits getshows Concurrent Sessions Used and Available when the API returns them; explicit JSON null renders as unknown (not “unlimited”), and rows stay hidden when fields are omitted.Vault credentials: Create specs must use an ordered
fieldsarray with stablename(and optionallabel); keyed-object create specs are rejected with guidance, and every field must have a name. Help/README clarify create vs update shapes. Tests cover label round-trip and field order.Checkout:
adyenis accepted forprepare_checkoutalongside updated README/command help (dummy card fields, device handoff caveats). AgentCardcard_idis documented and forwarded opaquely without format assumptions.Reviewed by Cursor Bugbot for commit e7efb10. Bugbot is set up for automated code reviews on this repo. Configure here.