[kernel-internal]

Summary

• Update the Go SDK to 738369d524a3806832577f6793dde7eaf15c5725.

Coverage

CLI coverage update report

SDK update

• Updated github.com/kernel/kernel-go-sdk from v0.137.0 to v0.138.0 (SDK commit 738369d524a3806832577f6793dde7eaf15c5725).
• Ran go get github.com/kernel/kernel-go-sdk@738369d524a3806832577f6793dde7eaf15c5725 and go mod tidy.

Coverage audit

• Enumerated all 176 methods in the SDK api.md and reviewed their parameter structs.
• Six SDK methods are intentionally excluded because their OpenAPI operations have x-cli-skip: true:
  • client.ConfigRegistry.List
  • client.ConfigRegistry.Lookup
  • client.ConfigRegistry.Resolve
  • client.ConfigRegistry.Analyses.Get
  • client.ConfigRegistry.Analyses.List
  • client.ConfigRegistry.Analyses.Cancel
• All 170 non-skipped SDK methods have corresponding CLI coverage.
• Compared SDK parameter fields with command flags and positional arguments. No missing command or flag coverage was found. Existing intentional CLI mappings include positional resource identifiers, page-based pagination where supported, and JSON/spec inputs for complex union payloads.

Gap analysis

Missing commands

• None.

Missing flags

• None.

Changes

Commands and flags

• No new SDK methods or request parameter fields were introduced, so no new commands or flags were required.

Response output

SDK v0.138.0 adds the browser-session response field leased_at. Following OpenAPI field components.schemas.Browser.leased_at, the CLI now shows Leased At for leased pooled sessions in human-readable output from:

• kernel browsers create when acquiring through --pool-id or --pool-name
• kernel browsers get
• kernel browsers update
• kernel browsers list (column shown only when at least one result is leased)
• kernel browser-pools acquire
• kernel invoke browsers (column shown only when at least one result is leased)

JSON output already includes leased_at through the updated SDK response models. No command Short/Long text or flag usage text needed adjustment because this release changes only a response field, not endpoint or request-field behavior.

Intentional exclusions

• Config Registry operations remain excluded as directed by x-cli-skip: true.
• Other OpenAPI operations marked x-cli-skip: true are not exposed as methods in this SDK release and therefore require no CLI command.

Validation

• go test ./cmd/... ./pkg/... — passed.
• Focused leased-session output tests — passed.
• go build ./... — passed.
• Built the CLI at /home/runner/work/_temp/cli-scratch/kernel and smoke-checked help for the affected commands.
• Real-API smoke tests were skipped under the task's no-new-command/no-new-flag rule. The response-only formatting change is covered by unit tests using SDK leased_at values.

Validation

• Go build
• Go vet
• Go tests

---

Note

Medium Risk
Large CLI surface for API keys, auth, browser lifecycle, and payment/vault operations; mistakes in validation or docs could mislead operators in security-sensitive flows, though behavior is mostly delegated to the API.

Overview
Updates the CLI for kernel-go-sdk v0.138.0, wiring new API capabilities into commands, flags, help text, and tests—not just response formatting.

API keys: create adds --expires-at (RFC3339, exclusive with --days-to-expire) and --policy (JSON allow statements with validation). List/get show Last Used At and support sorting by last_used_at.

Managed auth: --hitl on create/update pauses unsolved login CAPTCHAs for live-view completion; get/follow surface human intervention state, human_intervention choices, and Live View URL.

Browsers & pools: New browsers save-profile (overwrite/create profile, restarts session, no SDK retries). Create adds closed-beta --fingerprint-os. Update supports optimistic allowlist changes via --expected-allowlist-revision and --mutation-id; get shows allowlist revision/mutation. Leased At appears in human output wherever pooled leases return leased_at. Browser-pools update adds --expected-network for stale-network (409) protection.

Vaults / payments: Shop Pay wallets and cards, payment-requests (Link/KERNEL one-shot purchases), wallet add_payment_method / remove_payment_method, richer confirm_transaction parsing (order/failure fields, Shop Pay transaction types), Link payment_request authorize/fill parity, typed confirm payloads, and shared vaultWriteRequestOptions() on vault writes. Help and 1Password flows expand (target_id on 1pw_fill, pre-approved access-request specs).

^{Reviewed by Cursor Bugbot for commit d294c78. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.131.0 ⏵ v0.138.0	+1

View full report

[cursor]

Stale Bugbot comment from a previous run.

[hiroTamada]

reviewed — the vault no-replay middleware is a real fix (verified both subtests fail with writes=2 without it), and the new surfaces look well-guarded. a couple of questions, neither blocking:

Questions

• cmd/browsers.go:1109 — save-profile restarts the browser but uses default SDK retries (2x on 409/5xx/conn errors). help says "retry only browser_busy", but the SDK will also auto-retry browser_lease_changed/inactive 409s. consider option.WithMaxRetries(0) or confirm the API sends x-should-retry: false
• cmd/vaults_commands.go:498-537 — does the API accept PATCH on a KERNEL payment_request? cards update excludes kernel ("kernel cards cannot be updated", :466), but payment-requests update allows --provider kernel and its example (shared with create, :515) shows a KERNEL spec. if unsupported, mirror cards update; if supported, the "same lifecycle as the card" help needs a caveat

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d5e9abe. Configure here.}

[bmsaadat]

Holding this until the Shop Pay changes pass a smoke test through the real API (Raf's ask for the SDK bot PRs). The approval above predates the Shop Pay commits. I'll approve as soon as it passes.

[bmsaadat]

Smoke tested the Shop Pay changes against the prod API with a local build of this branch: wallet connect, card create, spec refusals, authorize at checkout, Shop approval, fill, a real $1 purchase on Kernel's Stripe link, and confirm_transaction (card consumed). All passed.