[kernel-internal]

Summary

• Update the Go SDK to v0.142.0.

Coverage

CLI coverage update through kernel-go-sdk v0.142.0

Summary

• Updated github.com/kernel/kernel-go-sdk from v0.141.0 to v0.142.0.
• Added CLI coverage for the new reserved ISP IP resource.
• Added reserved-IP pinning, moving, and filtering to existing proxy commands.
• Updated proxy and viewport help text to match the v0.142.0 API descriptions.
• Preserved the earlier branch coverage for WebMCP limits, current Search providers, KERNEL single-use cards, customer-managed Link token refresh, and VGS vault payments.

v0.142.0 commands and flags

New commands

• kernel proxy-ips list
  • Covers client.ProxyIPs.List / GET /proxy_ips.
  • Adds --country and --status active|excluded filters.
  • Uses the CLI page-based pagination UX with --page and --per-page, requests one extra item to detect more results, prints a pagination footer for human output, preserves filters in the quoted Next: command, and omits pagination metadata from JSON output.
  • Human output shows reserved IP address, country, and assignability status.
• kernel proxy-ips get <ip-address>
  • Covers client.ProxyIPs.Get / GET /proxy_ips/{ip_address}.
  • Shows the organization-wide proxy count and the matching proxies visible in the current project.

Existing command coverage

• kernel proxies create --ip-address <ipv4>
  • Covers ProxyNewParams.Config.OfIsp.IPAddress / IspProxyConfig.ip_address.
  • Pins an ISP proxy to an active reserved exit IP and rejects the flag for non-ISP proxy types.
• kernel proxies update --ip-address <ipv4>
  • Covers ProxyUpdateParams.Config.IPAddress / IspProxyUpdateConfig.ip_address.
  • Supports moving an ISP proxy while preserving its ID.
• kernel proxies update --name <name>
  • Updated for the v0.142.0 optional ProxyUpdateParams.Name field.
  • The command now requires at least one of --name or --ip-address, and permits both together.
• kernel proxies list --ip-address <ipv4>
  • Covers ProxyListParams.IPAddress / the GET /proxies ip_address query parameter.
  • Performs an exact primary-exit-IP match for ISP proxies.
• Proxy create/get/update/list human output now includes exit IP information; ISP config output identifies a reserved IP when the API returns it.

Help text synchronized with the API spec

v0.142.0

• GET /proxy_ips and GET /proxy_ips/{ip_address}
  • Added reserved-allocation availability, project/organization scope requirements, organization-wide versus current-project proxy visibility, and excluded-IP behavior.
• IspProxyConfig.country and IspProxyConfig.ip_address
  • Updated kernel proxies create country defaults and documented selecting an active reserved IP with kernel proxy-ips list.
• PATCH /proxies/{id_or_name}, ProxyUpdateRequest, and IspProxyUpdateConfig.ip_address
  • Replaced rename-only help with name-or-reserved-IP update behavior, probe-before-change semantics, live-connection transition behavior, and retry guidance for assignment/concurrency failures.
• GET /proxies ip_address
  • Added exact ISP primary-exit-IP filter help.
• BrowserViewport.width and BrowserViewport.height
  • Updated --viewport usage for browser and browser-pool create/update commands to state that dimensions must be positive and headful browsers require width and height of at least 64 pixels.

Coverage already present on this update branch

The diff against CLI main also includes earlier release coverage:

• POST /browsers/{id_or_name}/webmcp/invoke
  • Enforces the 4 MiB serialized input limit, documents unknown and page-unloaded outcomes, notes the custom-tool output limit, and verifies that side-effecting failures are not retried.
• Search request/provider fields
  • Updates provider help and validation to the current supported provider slugs, normalizes provider input to lowercase, and rejects removed or unknown providers before an API request.
• KERNEL card single_use_card fields
  • Adds protected --spec-file input for caller-supplied single-use card details, prevents inline secret input, filters sensitive values from output and errors, and documents expiry, fill-domain, billing-field, and non-consumption behavior.
• Link wallet authorization.token_refresh and the update_access_token vault item operation
  • Adds --token-refresh kernel|customer, supports access-token-only imports for customer-managed refresh, adds protected token replacement through vaults items invoke ... update_access_token --spec-file, and keeps tokens out of output/errors.
• VGS provider configuration, wallet, and card fields
  • Adds VGS service-account configuration with immutable vault/environment display, VGS wallet binding, protected card alias input through --spec-file, safe output filtering, provider-specific validation, and status/recovery guidance.
• 1Password fill descriptions
  • Clarifies that the extension determines login matching and when target_id or entry_id is required.

Full coverage review and exclusions

• Enumerated all 178 methods in the v0.142.0 SDK and their parameter structs.
• Enumerated all CLI commands and flags before and after this update.
• Six released SDK methods are intentionally excluded because their OpenAPI operations have x-cli-skip: true:
  • client.ConfigRegistry.List
  • client.ConfigRegistry.Lookup
  • client.ConfigRegistry.Resolve
  • client.ConfigRegistry.Analyses.Get
  • client.ConfigRegistry.Analyses.List
  • client.ConfigRegistry.Analyses.Cancel
• No other released SDK method or parameter coverage gaps remain.

Validation

• go test ./... — passed.
• go build ./... — passed.
• git diff --check — passed.
• Real API smoke tests:
  • kernel proxies list --ip-address 203.0.113.10 --output json succeeded and returned an empty JSON list.
  • Created a temporary ISP proxy, renamed it with kernel proxies update --name, verified the new name with kernel proxies get, and deleted it successfully.
  • Created a second temporary ISP proxy to exercise kernel proxies update --ip-address; the API rejected the move because reserved ISP IPs are not enabled for the test organization. The proxy remained readable and was deleted successfully.
  • kernel proxy-ips list, filtered list pagination flags, kernel proxy-ips get, and kernel proxies create --ip-address all reached the real API but were rejected with reserved_isp_not_enabled for the same organization-level limitation.

Successful reserved-IP listing, pinning, moving, and retrieval could not be verified in this environment because the authenticated organization has no reserved ISP allocation. Unit tests cover request construction, filtering, pagination, output, validation, and command wiring for those paths.

Validation

• Go build
• Go vet
• Go tests

---

Note

Medium Risk
Touches sensitive payment vault flows, new proxy IP moves, and stricter CLI validation—logic is well-tested but misconfiguration could block workflows or leak expectations about secrets.

Overview
Overview

Updates kernel-go-sdk to v0.142.0 and expands the CLI to cover the new reserved ISP proxy IP workflow, tighter WebMCP invoke guardrails, stricter Search provider validation, refreshed viewport help, and a large VGS/Kernel payment surface (single-use cards, customer token refresh, spec-file-only secrets).

Proxies & networking

Adds kernel proxy-ips list|get with page-based pagination, filters, human tables, and JSON output; kernel proxies create|update|list now understand --ip-address for pinning/moving/filtering ISP exits (with validation, richer tables, and SDK-backed fake updates); help strings document reserved allocations and optional renames.

WebMCP & Search

browsers webmcp invoke rejects payloads over 4 MiB, documents unknown/page-unloaded/custom-tool limits, and adds regression tests; kernel search enumerates supported provider slugs, lowercases input, and fails fast on deprecated names with refreshed tests/help.

Vaults & payments

Introduces VGS provider configs, wallets, and cards (including encrypted alias handling via --spec-file), KERNEL single-use cards with protected inputs and safer error paths, imported Link --token-refresh modes plus items invoke ... update_access_token --spec-file, broader help/output updates (1Password fill guidance, wallet/card flows, JSON filtering), and extensive tests covering the new behaviors.

^{Reviewed by Cursor Bugbot for commit 5f5793b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ae6f4d4. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.141.0 ⏵ v0.142.0	+1

View full report