From 83fd84c9c88bb7764fe8f7fdfba0523485906a2c Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:34:50 +0000
Subject: [PATCH 01/12] docs(api): clarify reuse/discard_all_idle pool config
 staleness

---
 .stats.yml                     |  4 ++--
 src/resources/browser-pools.ts | 13 ++++++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 0297d26..40adb55 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-ebbe079bb2542625826422afd876a3e8b499c579cf45efc5fd50e7982d34df7d.yml
-openapi_spec_hash: db850b61a0d71fe9f4b642df8782d7ae
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-83323f87ab825547b6cd11caa46e2643ebb0a68bbd326d4e07ccab970638fc03.yml
+openapi_spec_hash: 69ed04a66b4ef68e97f7bdc07dfe6df2
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/browser-pools.ts b/src/resources/browser-pools.ts
index 2cc6a0e..f157c72 100644
--- a/src/resources/browser-pools.ts
+++ b/src/resources/browser-pools.ts
@@ -581,8 +581,12 @@ export interface BrowserPoolUpdateParams {
   chrome_policy?: { [key: string]: unknown };
 
   /**
-   * Whether to discard all idle browsers and rebuild the pool immediately. Defaults
-   * to false.
+   * Whether to discard all idle browsers and rebuild them immediately with the new
+   * configuration. Defaults to false. Only browsers that are idle when the update
+   * runs are rebuilt. A browser that is in use during the update keeps its original
+   * configuration, and if it is later released with `reuse: true` it returns to the
+   * pool with that stale configuration until it is discarded (by this flag on a
+   * later update, or by flushing the pool).
    */
   discard_all_idle?: boolean;
 
@@ -752,7 +756,10 @@ export interface BrowserPoolReleaseParams {
 
   /**
    * Whether to reuse the browser instance or destroy it and create a new one.
-   * Defaults to true.
+   * Defaults to true. A reused browser keeps the configuration it was created with,
+   * so it does not pick up pool configuration changes made while it was in use.
+   * Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+   * current configuration.
    */
   reuse?: boolean;
 }

From aff324f5a779b188da8a3ab1f7d18726b35a2853 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 20:14:59 +0000
Subject: [PATCH 02/12] feat: Document env var redaction on deployment and app
 reads

---
 .stats.yml                   |  4 ++--
 src/resources/apps.ts        |  4 +++-
 src/resources/deployments.ts | 19 ++++++++++++++-----
 3 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 40adb55..34f9098 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-83323f87ab825547b6cd11caa46e2643ebb0a68bbd326d4e07ccab970638fc03.yml
-openapi_spec_hash: 69ed04a66b4ef68e97f7bdc07dfe6df2
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-89a500b26fe8126183d55aaca53f5615c6a25561d8e01e907f4998239ccc7a0b.yml
+openapi_spec_hash: 50236a5e713d5424ca35c0883926b0a5
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/apps.ts b/src/resources/apps.ts
index 915193d..c6710c9 100644
--- a/src/resources/apps.ts
+++ b/src/resources/apps.ts
@@ -47,7 +47,9 @@ export interface AppListResponse {
   deployment: string;
 
   /**
-   * Environment variables configured for this app version
+   * Environment variables configured for this app version. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars: { [key: string]: string };
 
diff --git a/src/resources/deployments.ts b/src/resources/deployments.ts
index a389f8b..597dad2 100644
--- a/src/resources/deployments.ts
+++ b/src/resources/deployments.ts
@@ -159,7 +159,9 @@ export namespace DeploymentStateEvent {
     entrypoint_rel_path?: string;
 
     /**
-     * Environment variables configured for this deployment
+     * Environment variables configured for this deployment. Values are redacted for
+     * API key, OAuth, and managed-auth callers, which receive every key with an empty
+     * string value. Only dashboard sessions receive the actual values.
      */
     env_vars?: { [key: string]: string };
 
@@ -205,7 +207,9 @@ export interface DeploymentCreateResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -250,7 +254,9 @@ export interface DeploymentRetrieveResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -295,7 +301,9 @@ export interface DeploymentListResponse {
   entrypoint_rel_path?: string;
 
   /**
-   * Environment variables configured for this deployment
+   * Environment variables configured for this deployment. Values are redacted for
+   * API key, OAuth, and managed-auth callers, which receive every key with an empty
+   * string value. Only dashboard sessions receive the actual values.
    */
   env_vars?: { [key: string]: string };
 
@@ -361,7 +369,8 @@ export namespace DeploymentFollowResponse {
     version: string;
 
     /**
-     * Environment variables configured for this app version
+     * Environment variables configured for this app version. Not currently populated
+     * on streamed app_version_summary events.
      */
     env_vars?: { [key: string]: string };
   }

From 08c48ee0e7236d4a83abcec7687b6093245940c4 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 18:01:45 +0000
Subject: [PATCH 03/12] codegen metadata

---
 .stats.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 34f9098..199caa1 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-89a500b26fe8126183d55aaca53f5615c6a25561d8e01e907f4998239ccc7a0b.yml
-openapi_spec_hash: 50236a5e713d5424ca35c0883926b0a5
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-073bade6de836ae1cf0cb3f8551cc5c6635f98649d7cf5059ef6819e9ce0f508.yml
+openapi_spec_hash: e84f887c72b5c7335158b706e4218bc7
 config_hash: 06186eb40e0058a2a87ac251fc07415d

From 9cac0f1dc231364362b3b1f7f9a0f48259205864 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 21:27:39 +0000
Subject: [PATCH 04/12] feat: Reject API key self-deletion

---
 .stats.yml                | 4 ++--
 src/resources/api-keys.ts | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 199caa1..02a158e 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-073bade6de836ae1cf0cb3f8551cc5c6635f98649d7cf5059ef6819e9ce0f508.yml
-openapi_spec_hash: e84f887c72b5c7335158b706e4218bc7
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-bd00e13bd6d37c150009e612ebeb6ef03d050610f80aaed517e283812c7b9ba9.yml
+openapi_spec_hash: 08c7c031877d6b882ff291b389937028
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts
index 60b41f5..a82e2c3 100644
--- a/src/resources/api-keys.ts
+++ b/src/resources/api-keys.ts
@@ -75,7 +75,8 @@ export class APIKeys extends APIResource {
   }
 
   /**
-   * Delete an API key.
+   * Delete an API key. A key cannot delete itself; use a different key to delete
+   * this one.
    *
    * @example
    * ```ts

From 44b2c99671cef89a61e2f84e734eb8800351bb20 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 21:51:35 +0000
Subject: [PATCH 05/12] feat: Store and return a sha256 checksum for uploaded
 extensions

---
 .stats.yml                  |  4 ++--
 src/resources/extensions.ts | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 02a158e..06a8191 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-bd00e13bd6d37c150009e612ebeb6ef03d050610f80aaed517e283812c7b9ba9.yml
-openapi_spec_hash: 08c7c031877d6b882ff291b389937028
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-e123113e7c86e8a61c763f0078adec5b0a7df621f2c31824e8f553331cf7a624.yml
+openapi_spec_hash: 940fb94967b6cb5e13daef6161d3abbf
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/extensions.ts b/src/resources/extensions.ts
index 79e98e1..809c2a3 100644
--- a/src/resources/extensions.ts
+++ b/src/resources/extensions.ts
@@ -147,6 +147,15 @@ export interface ExtensionListResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */
@@ -178,6 +187,15 @@ export interface ExtensionGetResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */
@@ -209,6 +227,15 @@ export interface ExtensionUploadResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */

From 4b702a92fd902bdf6b259e194a81e3ef0857149f Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:19:52 +0000
Subject: [PATCH 06/12] =?UTF-8?q?feat:=20Revert=20"Store=20and=20return=20?=
 =?UTF-8?q?a=20sha256=20checksum=20for=20uploaded=20extensions=20(#?=
 =?UTF-8?q?=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .stats.yml                  |  4 ++--
 src/resources/extensions.ts | 27 ---------------------------
 2 files changed, 2 insertions(+), 29 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 06a8191..70c2c4f 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-e123113e7c86e8a61c763f0078adec5b0a7df621f2c31824e8f553331cf7a624.yml
-openapi_spec_hash: 940fb94967b6cb5e13daef6161d3abbf
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4395690aa03bf5e2482d60132f7eebdbf88265af3d53098789f6c2f3c623d769.yml
+openapi_spec_hash: ad7c56d655a6e3899532caa4588a02b7
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/extensions.ts b/src/resources/extensions.ts
index 809c2a3..79e98e1 100644
--- a/src/resources/extensions.ts
+++ b/src/resources/extensions.ts
@@ -147,15 +147,6 @@ export interface ExtensionListResponse {
    */
   size_bytes: number;
 
-  /**
-   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
-   * extension archive bytes. This is not a normalized checksum of the extension
-   * contents; archive metadata, file ordering, and compression can change the
-   * checksum for otherwise identical contents. Omitted for legacy rows and
-   * server-repackaged Chrome Web Store extensions.
-   */
-  checksum?: string | null;
-
   /**
    * Timestamp when the extension was last used
    */
@@ -187,15 +178,6 @@ export interface ExtensionGetResponse {
    */
   size_bytes: number;
 
-  /**
-   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
-   * extension archive bytes. This is not a normalized checksum of the extension
-   * contents; archive metadata, file ordering, and compression can change the
-   * checksum for otherwise identical contents. Omitted for legacy rows and
-   * server-repackaged Chrome Web Store extensions.
-   */
-  checksum?: string | null;
-
   /**
    * Timestamp when the extension was last used
    */
@@ -227,15 +209,6 @@ export interface ExtensionUploadResponse {
    */
   size_bytes: number;
 
-  /**
-   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
-   * extension archive bytes. This is not a normalized checksum of the extension
-   * contents; archive metadata, file ordering, and compression can change the
-   * checksum for otherwise identical contents. Omitted for legacy rows and
-   * server-repackaged Chrome Web Store extensions.
-   */
-  checksum?: string | null;
-
   /**
    * Timestamp when the extension was last used
    */

From 3de38dfc16bdca8ebcdab22eec87b253e3fb49ce Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 15:31:24 +0000
Subject: [PATCH 07/12] feat: Accept comma-separated search_user_id in
 audit-logs endpoints

---
 .stats.yml | 4 ++--
 yarn.lock  | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 70c2c4f..2c231f1 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4395690aa03bf5e2482d60132f7eebdbf88265af3d53098789f6c2f3c623d769.yml
-openapi_spec_hash: ad7c56d655a6e3899532caa4588a02b7
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f6795e5d85e37b74f59876434c74b598e34171f99bc598c85b789abbb60614f1.yml
+openapi_spec_hash: 98e86fcbf0710a693bb1e03170ca85c3
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/yarn.lock b/yarn.lock
index c67c476..3540e21 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1222,9 +1222,9 @@ baseline-browser-mapping@^2.9.0:
   integrity sha512-B0xUquLkiGLgHhpPBqvl7GWegWBUNuujQ6kXd/r1U38ElPT6Ok8KZ8e+FpUGEc2ZoRQUzq/aUnaKFc/svWUGSg==
 
 brace-expansion@^2.0.2:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.1.tgz#c68b1c4111c76aae3a6fba55d496cee10c39dad8"
-  integrity sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.2.tgz#0bba2271feb7d458b0d31ad13625aaa4754431e2"
+  integrity sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==
   dependencies:
     balanced-match "^1.0.0"
 

From bb7b59ef8b3690bac2c34c50e5865e68a021c890 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:42:41 +0000
Subject: [PATCH 08/12] feat: Auto-flush pools when a managed auth profile
 re-authenticates

---
 .stats.yml                                |  4 +-
 src/resources/browser-pools.ts            | 91 ++++++++++++++---------
 tests/api-resources/browser-pools.test.ts |  1 +
 3 files changed, 57 insertions(+), 39 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 2c231f1..d888de6 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f6795e5d85e37b74f59876434c74b598e34171f99bc598c85b789abbb60614f1.yml
-openapi_spec_hash: 98e86fcbf0710a693bb1e03170ca85c3
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-58ad412d62b3d94e3258c911d7028716d71191358ff769ce494c4b2d87027254.yml
+openapi_spec_hash: 45d710b7d2a9beadff021514bb997ba1
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/browser-pools.ts b/src/resources/browser-pools.ts
index f157c72..39c9d8b 100644
--- a/src/resources/browser-pools.ts
+++ b/src/resources/browser-pools.ts
@@ -48,7 +48,9 @@ export class BrowserPools extends APIResource {
   /**
    * Updates the configuration used to create browsers in the pool. As with creation,
    * save_changes on the pool profile is ignored (not rejected); pooled browsers
-   * never persist changes back to the profile.
+   * never persist changes back to the profile. To clear the profile reference, send
+   * `profile: { "id": "" }`. Clearing the profile also disables
+   * `refresh_on_profile_update`.
    *
    * @example
    * ```ts
@@ -241,12 +243,11 @@ export namespace BrowserPool {
     name?: string;
 
     /**
-     * Profile selection for browsers in a pool. Provide either id or name. The
-     * matching profile is loaded into every browser in the pool. Profiles must be
-     * created beforehand. Unlike single browser sessions, pools load the profile
-     * read-only and never persist changes back to it, so save_changes is omitted here.
-     * Any save_changes value sent on a pool profile is silently ignored rather than
-     * rejected, so callers reusing a single-session profile object will not error.
+     * Profile configuration for browsers in a pool. Provide either id or name.
+     * Profiles must be created beforehand. Unlike single browser sessions, pools load
+     * the profile read-only and never persist changes back to it, so save_changes is
+     * omitted here. Any save_changes value sent on a pool profile is silently ignored
+     * rather than rejected.
      */
     profile?: BrowserPoolConfig.Profile;
 
@@ -256,6 +257,13 @@ export namespace BrowserPool {
      */
     proxy_id?: string;
 
+    /**
+     * When true, flush idle browsers when the profile the pool uses is updated, so
+     * pool browsers pick up the latest profile data. Requires a profile to be set on
+     * the pool.
+     */
+    refresh_on_profile_update?: boolean;
+
     /**
      * Optional URL to navigate to when a new browser is warmed into the pool.
      * Best-effort: failures to navigate do not fail pool fill. Only applied to
@@ -296,12 +304,11 @@ export namespace BrowserPool {
 
   export namespace BrowserPoolConfig {
     /**
-     * Profile selection for browsers in a pool. Provide either id or name. The
-     * matching profile is loaded into every browser in the pool. Profiles must be
-     * created beforehand. Unlike single browser sessions, pools load the profile
-     * read-only and never persist changes back to it, so save_changes is omitted here.
-     * Any save_changes value sent on a pool profile is silently ignored rather than
-     * rejected, so callers reusing a single-session profile object will not error.
+     * Profile configuration for browsers in a pool. Provide either id or name.
+     * Profiles must be created beforehand. Unlike single browser sessions, pools load
+     * the profile read-only and never persist changes back to it, so save_changes is
+     * omitted here. Any save_changes value sent on a pool profile is silently ignored
+     * rather than rejected.
      */
     export interface Profile {
       /**
@@ -495,12 +502,11 @@ export interface BrowserPoolCreateParams {
   name?: string;
 
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   profile?: BrowserPoolCreateParams.Profile;
 
@@ -510,6 +516,13 @@ export interface BrowserPoolCreateParams {
    */
   proxy_id?: string;
 
+  /**
+   * When true, flush idle browsers when the profile the pool uses is updated, so
+   * pool browsers pick up the latest profile data. Requires a profile to be set on
+   * the pool.
+   */
+  refresh_on_profile_update?: boolean;
+
   /**
    * Optional URL to navigate to when a new browser is warmed into the pool.
    * Best-effort: failures to navigate do not fail pool fill. Only applied to
@@ -550,12 +563,11 @@ export interface BrowserPoolCreateParams {
 
 export namespace BrowserPoolCreateParams {
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   export interface Profile {
     /**
@@ -619,12 +631,11 @@ export interface BrowserPoolUpdateParams {
   name?: string;
 
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   profile?: BrowserPoolUpdateParams.Profile;
 
@@ -634,6 +645,13 @@ export interface BrowserPoolUpdateParams {
    */
   proxy_id?: string;
 
+  /**
+   * When true, flush idle browsers when the profile the pool uses is updated, so
+   * pool browsers pick up the latest profile data. Requires a profile to be set on
+   * the pool.
+   */
+  refresh_on_profile_update?: boolean;
+
   /**
    * Number of browsers to maintain in the pool. The maximum size is determined by
    * your organization's pooled sessions limit (the sum of all pool sizes cannot
@@ -681,12 +699,11 @@ export interface BrowserPoolUpdateParams {
 
 export namespace BrowserPoolUpdateParams {
   /**
-   * Profile selection for browsers in a pool. Provide either id or name. The
-   * matching profile is loaded into every browser in the pool. Profiles must be
-   * created beforehand. Unlike single browser sessions, pools load the profile
-   * read-only and never persist changes back to it, so save_changes is omitted here.
-   * Any save_changes value sent on a pool profile is silently ignored rather than
-   * rejected, so callers reusing a single-session profile object will not error.
+   * Profile configuration for browsers in a pool. Provide either id or name.
+   * Profiles must be created beforehand. Unlike single browser sessions, pools load
+   * the profile read-only and never persist changes back to it, so save_changes is
+   * omitted here. Any save_changes value sent on a pool profile is silently ignored
+   * rather than rejected.
    */
   export interface Profile {
     /**
diff --git a/tests/api-resources/browser-pools.test.ts b/tests/api-resources/browser-pools.test.ts
index 37fda3c..bb7370a 100644
--- a/tests/api-resources/browser-pools.test.ts
+++ b/tests/api-resources/browser-pools.test.ts
@@ -32,6 +32,7 @@ describe('resource browserPools', () => {
       name: 'my-pool',
       profile: { id: 'id', name: 'name' },
       proxy_id: 'proxy_id',
+      refresh_on_profile_update: true,
       start_url: 'https://example.com',
       stealth: true,
       timeout_seconds: 10,

From 3c911f2757e64c4bc93cf4f45c475adbd28deec2 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:59:28 +0000
Subject: [PATCH 09/12] codegen metadata

---
 .stats.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index d888de6..9c64d8c 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-58ad412d62b3d94e3258c911d7028716d71191358ff769ce494c4b2d87027254.yml
-openapi_spec_hash: 45d710b7d2a9beadff021514bb997ba1
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4655211f0824a1eb5d534731697ea215c19e769e3c63ac61ca306c7a3140b0b4.yml
+openapi_spec_hash: 0a440e663f1704d4b9a3a3ac5fa75ffb
 config_hash: 06186eb40e0058a2a87ac251fc07415d

From 5782907899949dd9aafadefd8d3887cb3b7d4d16 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 19:54:55 +0000
Subject: [PATCH 10/12] feat: Store and return a sha256 checksum for uploaded
 extensions (reland)

---
 .stats.yml                  |  4 ++--
 src/resources/extensions.ts | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 9c64d8c..1d73bab 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4655211f0824a1eb5d534731697ea215c19e769e3c63ac61ca306c7a3140b0b4.yml
-openapi_spec_hash: 0a440e663f1704d4b9a3a3ac5fa75ffb
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f040d3f5c26d6e0d312206b294d3745b272e26b883e7d704f6b4c45dd438cd01.yml
+openapi_spec_hash: 56f4918d2e3f8d717ffe3643a20feb96
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/extensions.ts b/src/resources/extensions.ts
index 79e98e1..809c2a3 100644
--- a/src/resources/extensions.ts
+++ b/src/resources/extensions.ts
@@ -147,6 +147,15 @@ export interface ExtensionListResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */
@@ -178,6 +187,15 @@ export interface ExtensionGetResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */
@@ -209,6 +227,15 @@ export interface ExtensionUploadResponse {
    */
   size_bytes: number;
 
+  /**
+   * SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+   * extension archive bytes. This is not a normalized checksum of the extension
+   * contents; archive metadata, file ordering, and compression can change the
+   * checksum for otherwise identical contents. Omitted for legacy rows and
+   * server-repackaged Chrome Web Store extensions.
+   */
+  checksum?: string | null;
+
   /**
    * Timestamp when the extension was last used
    */

From 9ad571674fe95c1acb44f47ffbfdeaa7c81cdb5e Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 21:17:18 +0000
Subject: [PATCH 11/12] feat: Expose resolved profile_id and extension_ids on
 browser pool reads

---
 .stats.yml                     |  4 ++--
 src/resources/browser-pools.ts | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 1d73bab..f8ffb2d 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f040d3f5c26d6e0d312206b294d3745b272e26b883e7d704f6b4c45dd438cd01.yml
-openapi_spec_hash: 56f4918d2e3f8d717ffe3643a20feb96
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f0486d0b8e34ddf8ba34e36ff97856cf973e0797e021ff621e04e4840970966e.yml
+openapi_spec_hash: 12a71ce5ac80fc65f6a8779f0ca29223
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/resources/browser-pools.ts b/src/resources/browser-pools.ts
index 39c9d8b..a810bc8 100644
--- a/src/resources/browser-pools.ts
+++ b/src/resources/browser-pools.ts
@@ -188,10 +188,26 @@ export interface BrowserPool {
    */
   created_at: string;
 
+  /**
+   * Resolved extension IDs attached to the pool, in configured load order. Empty
+   * when no extensions are attached. Authoritative for programmatic consumers; the
+   * extensions inside `browser_pool_config` reflect the configured selector (echoed
+   * as sent on create).
+   */
+  extension_ids: Array<string>;
+
   /**
    * Browser pool name, if set
    */
   name?: string;
+
+  /**
+   * Resolved profile ID the pool is attached to. Omitted when no profile is
+   * attached. Authoritative for programmatic consumers; the profile inside
+   * `browser_pool_config` reflects the configured selector (echoed as sent on
+   * create).
+   */
+  profile_id?: string;
 }
 
 export namespace BrowserPool {

From ba622abe33f3c95c697f8242d5c576c351852ae3 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 21:17:46 +0000
Subject: [PATCH 12/12] release: 0.75.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 20 ++++++++++++++++++++
 package.json                  |  2 +-
 src/version.ts                |  2 +-
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 52ffe5a..7b0cc97 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.74.0"
+  ".": "0.75.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 689aff5..4976d34 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.75.0 (2026-07-08)
+
+Full Changelog: [v0.74.0...v0.75.0](https://github.com/kernel/kernel-node-sdk/compare/v0.74.0...v0.75.0)
+
+### Features
+
+* Accept comma-separated search_user_id in audit-logs endpoints ([3de38df](https://github.com/kernel/kernel-node-sdk/commit/3de38dfc16bdca8ebcdab22eec87b253e3fb49ce))
+* Auto-flush pools when a managed auth profile re-authenticates ([bb7b59e](https://github.com/kernel/kernel-node-sdk/commit/bb7b59ef8b3690bac2c34c50e5865e68a021c890))
+* Document env var redaction on deployment and app reads ([aff324f](https://github.com/kernel/kernel-node-sdk/commit/aff324f5a779b188da8a3ab1f7d18726b35a2853))
+* Expose resolved profile_id and extension_ids on browser pool reads ([9ad5716](https://github.com/kernel/kernel-node-sdk/commit/9ad571674fe95c1acb44f47ffbfdeaa7c81cdb5e))
+* Reject API key self-deletion ([9cac0f1](https://github.com/kernel/kernel-node-sdk/commit/9cac0f1dc231364362b3b1f7f9a0f48259205864))
+* Revert "Store and return a sha256 checksum for uploaded extensions (#… ([4b702a9](https://github.com/kernel/kernel-node-sdk/commit/4b702a92fd902bdf6b259e194a81e3ef0857149f))
+* Store and return a sha256 checksum for uploaded extensions ([44b2c99](https://github.com/kernel/kernel-node-sdk/commit/44b2c99671cef89a61e2f84e734eb8800351bb20))
+* Store and return a sha256 checksum for uploaded extensions (reland) ([5782907](https://github.com/kernel/kernel-node-sdk/commit/5782907899949dd9aafadefd8d3887cb3b7d4d16))
+
+
+### Documentation
+
+* **api:** clarify reuse/discard_all_idle pool config staleness ([83fd84c](https://github.com/kernel/kernel-node-sdk/commit/83fd84c9c88bb7764fe8f7fdfba0523485906a2c))
+
 ## 0.74.0 (2026-07-06)
 
 Full Changelog: [v0.73.0...v0.74.0](https://github.com/kernel/kernel-node-sdk/compare/v0.73.0...v0.74.0)
diff --git a/package.json b/package.json
index 6ee8ffa..d020614 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",
diff --git a/src/version.ts b/src/version.ts
index c88d4bf..766f1ae 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = '0.74.0'; // x-release-please-version
+export const VERSION = '0.75.0'; // x-release-please-version