From 364255de6aa44d55e1563dec5696d76a4516e325 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 17:52:50 +0000 Subject: [PATCH 1/5] feat: Add video_memory to request the 4GiB VRAM GPU browser tier Stainless-Generated-From: c3cebc545088ae51dfdf56ff719574a4d6d94415 --- api.md | 1 + src/client.ts | 2 ++ src/resources/browser-pools.ts | 5 +++ src/resources/browsers/browsers.ts | 36 ++++++++++++++++++- src/resources/browsers/index.ts | 1 + src/resources/index.ts | 1 + src/resources/invocations.ts | 5 +++ tests/api-resources/browsers/browsers.test.ts | 1 + 8 files changed, 51 insertions(+), 1 deletion(-) diff --git a/api.md b/api.md index 8b6dbe29..dc9f57e2 100644 --- a/api.md +++ b/api.md @@ -113,6 +113,7 @@ Types: - BrowserReplResult - BrowserReplTextContent - BrowserUsage +- BrowserVideoMemory - Profile - Tags - VaultReference diff --git a/src/client.ts b/src/client.ts index b53bdaa3..2bb96d8e 100644 --- a/src/client.ts +++ b/src/client.ts @@ -180,6 +180,7 @@ import { BrowserUpdateParams, BrowserUpdateResponse, BrowserUsage, + BrowserVideoMemory, Browsers, Profile, Tags, @@ -1234,6 +1235,7 @@ export declare namespace Kernel { type BrowserReplResult as BrowserReplResult, type BrowserReplTextContent as BrowserReplTextContent, type BrowserUsage as BrowserUsage, + type BrowserVideoMemory as BrowserVideoMemory, type Profile as Profile, type Tags as Tags, type VaultReference as VaultReference, diff --git a/src/resources/browser-pools.ts b/src/resources/browser-pools.ts index f3b507f0..79dec766 100644 --- a/src/resources/browser-pools.ts +++ b/src/resources/browser-pools.ts @@ -517,6 +517,11 @@ export interface BrowserPoolAcquireResponse { */ vaults?: Array; + /** + * Video memory (VRAM) of the GPU browser session. Only present when gpu is true. + */ + video_memory?: BrowsersAPI.BrowserVideoMemory; + /** * Initial browser window size in pixels with optional refresh rate. If omitted, * image defaults apply (1920x1080@25). For GPU images, the default is diff --git a/src/resources/browsers/browsers.ts b/src/resources/browsers/browsers.ts index 7854d497..9a2391d3 100644 --- a/src/resources/browsers/browsers.ts +++ b/src/resources/browsers/browsers.ts @@ -349,7 +349,7 @@ export type ProfilesOffsetPagination = OffsetPagination; /** * Memory allocated to the browser session. */ -export type BrowserMemory = '1GiB' | '2GiB' | '6GiB' | '8GiB' | '16GiB'; +export type BrowserMemory = '1GiB' | '2GiB' | '6GiB' | '8GiB' | '12GiB' | '16GiB'; /** * Memory requested for a headful, non-GPU browser session. @@ -670,6 +670,12 @@ export interface BrowserUsage { uptime_ms: number; } +/** + * Video memory (VRAM) of a GPU browser session. 2GiB sessions have 4 vCPU and 6GiB + * memory. 4GiB sessions have 8 vCPU and 12GiB memory. + */ +export type BrowserVideoMemory = '2GiB' | '4GiB'; + /** * Browser profile metadata. */ @@ -868,6 +874,11 @@ export interface BrowserCreateResponse { */ vaults?: Array; + /** + * Video memory (VRAM) of the GPU browser session. Only present when gpu is true. + */ + video_memory?: BrowserVideoMemory; + /** * Initial browser window size in pixels with optional refresh rate. If omitted, * image defaults apply (1920x1080@25). For GPU images, the default is @@ -1039,6 +1050,11 @@ export interface BrowserRetrieveResponse { */ vaults?: Array; + /** + * Video memory (VRAM) of the GPU browser session. Only present when gpu is true. + */ + video_memory?: BrowserVideoMemory; + /** * Initial browser window size in pixels with optional refresh rate. If omitted, * image defaults apply (1920x1080@25). For GPU images, the default is @@ -1210,6 +1226,11 @@ export interface BrowserUpdateResponse { */ vaults?: Array; + /** + * Video memory (VRAM) of the GPU browser session. Only present when gpu is true. + */ + video_memory?: BrowserVideoMemory; + /** * Initial browser window size in pixels with optional refresh rate. If omitted, * image defaults apply (1920x1080@25). For GPU images, the default is @@ -1381,6 +1402,11 @@ export interface BrowserListResponse { */ vaults?: Array; + /** + * Video memory (VRAM) of the GPU browser session. Only present when gpu is true. + */ + video_memory?: BrowserVideoMemory; + /** * Initial browser window size in pixels with optional refresh rate. If omitted, * image defaults apply (1920x1080@25). For GPU images, the default is @@ -1556,6 +1582,13 @@ export interface BrowserCreateParams { */ vaults?: Array; + /** + * Video memory (VRAM) for a GPU browser session. Requires gpu=true. Defaults to + * 2GiB, which comes with 4 vCPU and 6GiB memory. 4GiB comes with 8 vCPU and 12GiB + * memory. + */ + video_memory?: BrowserVideoMemory; + /** * Initial browser window size in pixels with optional refresh rate. If omitted, * image defaults apply (1920x1080@25). For GPU images, the default is @@ -2016,6 +2049,7 @@ export declare namespace Browsers { type BrowserReplResult as BrowserReplResult, type BrowserReplTextContent as BrowserReplTextContent, type BrowserUsage as BrowserUsage, + type BrowserVideoMemory as BrowserVideoMemory, type Profile as Profile, type Tags as Tags, type VaultReference as VaultReference, diff --git a/src/resources/browsers/index.ts b/src/resources/browsers/index.ts index 1c19f2f5..155be0d2 100644 --- a/src/resources/browsers/index.ts +++ b/src/resources/browsers/index.ts @@ -16,6 +16,7 @@ export { type BrowserReplResult, type BrowserReplTextContent, type BrowserUsage, + type BrowserVideoMemory, type Profile, type Tags, type VaultReference, diff --git a/src/resources/index.ts b/src/resources/index.ts index 3255e808..dd6978cd 100644 --- a/src/resources/index.ts +++ b/src/resources/index.ts @@ -54,6 +54,7 @@ export { type BrowserReplResult, type BrowserReplTextContent, type BrowserUsage, + type BrowserVideoMemory, type Profile, type Tags, type VaultReference, diff --git a/src/resources/invocations.ts b/src/resources/invocations.ts index 3d273cc5..266197da 100644 --- a/src/resources/invocations.ts +++ b/src/resources/invocations.ts @@ -601,6 +601,11 @@ export namespace InvocationListBrowsersResponse { */ vaults?: Array; + /** + * Video memory (VRAM) of the GPU browser session. Only present when gpu is true. + */ + video_memory?: BrowsersAPI.BrowserVideoMemory; + /** * Initial browser window size in pixels with optional refresh rate. If omitted, * image defaults apply (1920x1080@25). For GPU images, the default is diff --git a/tests/api-resources/browsers/browsers.test.ts b/tests/api-resources/browsers/browsers.test.ts index 35a27c90..3a8ea143 100644 --- a/tests/api-resources/browsers/browsers.test.ts +++ b/tests/api-resources/browsers/browsers.test.ts @@ -86,6 +86,7 @@ describe('resource browsers', () => { }, timeout_seconds: 10, vaults: [{ id: 'id', name: 'x' }], + video_memory: '2GiB', viewport: { height: 800, width: 1280, From 4133242031661afedca190f247a1c19e01070096 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 18:16:46 +0000 Subject: [PATCH 2/5] feat: Fix 1Password fill classification for repeat fills and unconfirmed submits Stainless-Generated-From: 7beffee1aff8dd25d34d9c69fcb00f40f5b96b86 --- src/resources/vaults/items.ts | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index dc1cee73..c70f7665 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -993,14 +993,15 @@ export namespace CredentialVaultItem { * they choose 1Password, connect their account and request access to a login in * their own non-shared vault; passkeys are not supported. If they decline or that * path fails, collect a Kernel-hosted credential item instead. Never automatically - * retry an uncertain 1Password request or fill. Do not use credential items for - * credit card data. Use wallet and card item types instead. Kernel credentials - * declare fields and may enter pending_collection. 1Password credentials either - * reference a connected credential_account or store a supplied access token and - * integration key encrypted on the item. They store no login values or selectors. - * Managed auth credentials reference a managed auth connection in the same project - * that already has a saved credential, and read it at fill time; they store no - * values. Repeating the original creation request returns the current item without + * retry an uncertain 1Password request. After an uncertain fill, inspect the page + * to see the result of the fill. Do not use credential items for credit card data. + * Use wallet and card item types instead. Kernel credentials declare fields and + * may enter pending_collection. 1Password credentials either reference a connected + * credential_account or store a supplied access token and integration key + * encrypted on the item. They store no login values or selectors. Managed auth + * credentials reference a managed auth connection in the same project that already + * has a saved credential, and read it at fill time; they store no values. + * Repeating the original creation request returns the current item without * overwriting later state. A different request at the same key returns 409. */ export interface CredentialVaultItemRequest { @@ -1774,17 +1775,19 @@ export interface OnePasswordFillVaultItemOperationResult { /** * Kernel's outcome of the extension call. fill_submitted means the extension * reported submission, not website authentication. fill_failed means the extension - * returned a known failure and may include error_code. fill_unknown means - * submission may have happened without a conclusive response; it has no error_code - * and must not be retried in the same browser. + * returned a known failure and includes error_code. fill_unknown means the form + * may have been filled or submitted without a conclusive result; inspect the page + * to see the result of the fill. */ status: 'fill_submitted' | 'fill_failed' | 'fill_unknown'; type: '1pw_fill'; /** - * Present only for a conclusive fill_failed response. These are allowlisted - * 1Password extension codes, never raw errors, secrets, or page content. + * Present for fill_failed, and for fill_unknown when the extension reported + * autosubmitFailed (it filled and submitted the form but could not confirm the + * fill finished). These are allowlisted 1Password extension codes, never raw + * errors, secrets, or page content. */ error_code?: 'fillFailed' | 'autosubmitFailed' | 'noExistingCredentials' | 'authenticationFailed'; } From 41f49801bfe0c7fa67cacc13c096f07270b2a6af Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 19:14:53 +0000 Subject: [PATCH 3/5] feat: Support egress allowlists on browser pools Stainless-Generated-From: d43869196ffc2e658542e91ae32e1a8ffa45b284 --- src/resources/browser-pools.ts | 26 ++++++++++++++++---------- src/resources/browsers/browsers.ts | 12 ++++++++---- 2 files changed, 24 insertions(+), 14 deletions(-) diff --git a/src/resources/browser-pools.ts b/src/resources/browser-pools.ts index 79dec766..170665a3 100644 --- a/src/resources/browser-pools.ts +++ b/src/resources/browser-pools.ts @@ -590,9 +590,9 @@ export interface BrowserPoolCreateParams { name?: string; /** - * Network configuration applied to browsers in this pool. Proxy routes require - * proxy-v3; the pool will not provision browsers through Envoy if proxy-v3 is - * unavailable. + * Network configuration applied to browsers in this pool. Egress allowlists and + * proxy routes require proxy-v3; the pool will not provision browsers through + * Envoy if proxy-v3 is unavailable. */ network?: BrowsersAPI.BrowserNetworkConfig; @@ -819,9 +819,11 @@ export interface BrowserPoolUpdateParams { * Whether to discard all idle browsers and rebuild them immediately with the new * configuration. Defaults to false. Only browsers that are idle when the update * runs are rebuilt. A browser that is in use during the update keeps its original - * configuration, and if it is later released with `reuse: true` it returns to the - * pool with that stale configuration until it is discarded (by this flag on a - * later update, or by flushing the pool). + * configuration, except that its allowlist is reset to the current pool baseline + * on release or the browser is replaced. For other configuration fields, if it is + * later released with `reuse: true` it returns to the pool with that stale + * configuration until it is discarded (by this flag on a later update, or by + * flushing the pool). */ discard_all_idle?: boolean; @@ -865,10 +867,14 @@ export interface BrowserPoolUpdateParams { * If provided, replaces the pool's network configuration. Omit to leave the * existing configuration unchanged; an empty object ({}) removes it, while * network: {private_hosts: []} or network: {proxy_routes: []} sets an explicit - * empty list. Proxy routes require proxy-v3; the pool will not provision browsers - * through Envoy if proxy-v3 is unavailable. Only applied to browsers created in - * the pool after the update; browsers already in the pool keep their configuration - * until discarded (see discard_all_idle). + * empty list; allowed_hosts must be non-empty when supplied. Egress allowlists and + * proxy routes require proxy-v3; the pool will not provision browsers through + * Envoy if proxy-v3 is unavailable. Changing allowed_hosts automatically replaces + * idle browsers. Leased browsers retain their allowlist until release, when it is + * reset to the current pool baseline or the browser is replaced if it cannot + * safely receive that baseline. Stale browsers cannot be acquired. Other network + * fields only apply to browsers created after the update; existing browsers keep + * those fields until discarded (see discard_all_idle). */ network?: BrowsersAPI.BrowserNetworkConfig; diff --git a/src/resources/browsers/browsers.ts b/src/resources/browsers/browsers.ts index 9a2391d3..f3c40ec6 100644 --- a/src/resources/browsers/browsers.ts +++ b/src/resources/browsers/browsers.ts @@ -380,8 +380,10 @@ export interface BrowserNetworkConfig { * processes in the browser VM that do not use the browser's proxy, are not * filtered, and Kernel's own control traffic is always allowed. Can be replaced or * removed while the session runs with PATCH /browsers/{id_or_name}, but not added - * to a browser created without one. Requires proxy v3. Not supported on browser - * pools. + * to a browser created without one. Supported on browser pools and their leased + * browsers. Per-lease changes are reset to the pool's allowlist on release. If a + * lessee removes the allowlist and the pool still requires one, the browser is + * replaced on release rather than given an allowlist again. Requires proxy v3. */ allowed_hosts?: Array; @@ -475,8 +477,10 @@ export interface BrowserNetworkUpdate { * minutes during a Kernel deploy. Connections to destinations it still allows, * such as WebSockets, stay open. A start_url in the same request must be allowed * by the updated list, and is loaded only after the list takes effect. Requires a - * browser created with proxy v3, and not supported on pooled browsers. If the - * request fails, retry it: the new list may already apply to some requests. + * browser created with proxy v3. Supported on leased pooled browsers; the pool's + * allowlist is restored before reuse, or the browser is destroyed if it cannot be + * safely restored. If the request fails, retry it: the new list may already apply + * to some requests. */ allowed_hosts?: Array | null; } From 2ccedc68f5abfbfe048145e0ca91fc4f4707e130 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 20:06:50 +0000 Subject: [PATCH 4/5] feat: Filter the telemetry SSE stream by event type Stainless-Generated-From: 00f1045bd90b91a504bf1868b37a912460d03ac1 --- src/resources/browsers/telemetry.ts | 16 +++++++++++++++- tests/api-resources/browsers/telemetry.test.ts | 6 +++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/src/resources/browsers/telemetry.ts b/src/resources/browsers/telemetry.ts index 46b50f27..e1e2dac3 100644 --- a/src/resources/browsers/telemetry.ts +++ b/src/resources/browsers/telemetry.ts @@ -47,7 +47,10 @@ export class Telemetry extends APIResource { * stream closes when the browser session terminates. Each event frame includes an * id: field containing a monotonically increasing sequence number; pass it as * Last-Event-ID on reconnect to resume without gaps. The event: field is never - * set; all frames carry JSON in the data: field. A keepalive comment frame is sent + * set; event frames carry JSON in the data: field. A frame with an id: field and + * no data: field moves Last-Event-ID past events that were not delivered, because + * a type filter excluded them or they could not be decoded or exceeded the size + * limit; SSE clients dispatch no event for it. A keepalive comment frame is sent * every 15 seconds when no events arrive. Returns 404 if the browser session does * not exist. If telemetry was not enabled on the session, the stream opens but no * events are delivered. Fresh connections only see new events; pass replay=all to @@ -4996,6 +4999,17 @@ export interface TelemetryStreamParams { */ replay?: string; + /** + * Query param: Deliver only these event types, such as captcha_solve_started or + * captcha_challenge_result. Repeat the parameter or pass comma-separated values + * for multiple types. Keepalive frames are always delivered. Filtered-out events + * are not sent. An id-only frame carrying the latest skipped id is sent about + * every 15 seconds while skipped events keep arriving, and otherwise with the next + * keepalive or when the stream ends, so the connection stays active and + * Last-Event-ID moves past them; a reconnect resumes after the skipped events. + */ + type?: Array; + /** * Header param: Last event sequence number for SSE reconnection (sent by SSE * clients on reconnect). Takes precedence over replay when both are present, so diff --git a/tests/api-resources/browsers/telemetry.test.ts b/tests/api-resources/browsers/telemetry.test.ts index 1485ed1b..3a7ef90b 100644 --- a/tests/api-resources/browsers/telemetry.test.ts +++ b/tests/api-resources/browsers/telemetry.test.ts @@ -58,7 +58,11 @@ describe('resource telemetry', () => { await expect( client.browsers.telemetry.stream( 'htzv5orfit78e1m2biiifpbv', - { replay: 'replay', 'Last-Event-ID': 'Last-Event-ID' }, + { + replay: 'replay', + type: ['string'], + 'Last-Event-ID': 'Last-Event-ID', + }, { path: '/_stainless_unknown_path' }, ), ).rejects.toThrow(Kernel.NotFoundError); From 16cec8288f1a22b33ebfde1975ec222f59f4e995 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 20:11:56 +0000 Subject: [PATCH 5/5] release: 0.123.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 10 ++++++++++ package.json | 2 +- src/version.ts | 2 +- 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index df1862d1..768a5b8e 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.122.0" + ".": "0.123.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index ec86e0d4..8734dbdb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## [0.123.0](https://github.com/kernel/kernel-node-sdk/compare/v0.122.0...v0.123.0) (2026-10-09) + + +### Features + +* Add video_memory to request the 4GiB VRAM GPU browser tier ([364255d](https://github.com/kernel/kernel-node-sdk/commit/364255de6aa44d55e1563dec5696d76a4516e325)) +* Filter the telemetry SSE stream by event type ([2ccedc6](https://github.com/kernel/kernel-node-sdk/commit/2ccedc68f5abfbfe048145e0ca91fc4f4707e130)) +* Fix 1Password fill classification for repeat fills and unconfirmed submits ([4133242](https://github.com/kernel/kernel-node-sdk/commit/4133242031661afedca190f247a1c19e01070096)) +* Support egress allowlists on browser pools ([41f4980](https://github.com/kernel/kernel-node-sdk/commit/41f49801bfe0c7fa67cacc13c096f07270b2a6af)) + ## [0.122.0](https://github.com/kernel/kernel-node-sdk/compare/v0.121.0...v0.122.0) (2026-10-09) diff --git a/package.json b/package.json index 39e5a879..12f3695d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.122.0", + "version": "0.123.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index 3bf6938c..197f7f0d 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.122.0'; // x-release-please-version +export const VERSION = '0.123.0'; // x-release-please-version