release: 0.123.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.122.0"
+  ".": "0.123.0"
 }

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.123.0](https://github.com/kernel/kernel-node-sdk/compare/v0.122.0...v0.123.0) (2026-10-09)
+
+
+### Features
+
+* Add video_memory to request the 4GiB VRAM GPU browser tier ([364255d](https://github.com/kernel/kernel-node-sdk/commit/364255de6aa44d55e1563dec5696d76a4516e325))
+* Filter the telemetry SSE stream by event type ([2ccedc6](https://github.com/kernel/kernel-node-sdk/commit/2ccedc68f5abfbfe048145e0ca91fc4f4707e130))
+* Fix 1Password fill classification for repeat fills and unconfirmed submits ([4133242](https://github.com/kernel/kernel-node-sdk/commit/4133242031661afedca190f247a1c19e01070096))
+* Support egress allowlists on browser pools ([41f4980](https://github.com/kernel/kernel-node-sdk/commit/41f49801bfe0c7fa67cacc13c096f07270b2a6af))
+
 ## [0.122.0](https://github.com/kernel/kernel-node-sdk/compare/v0.121.0...v0.122.0) (2026-10-09)
 
 

api.md

@@ -113,6 +113,7 @@ Types:
 - <code><a href="./src/resources/browsers/browsers.ts">BrowserReplResult</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">BrowserReplTextContent</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">BrowserUsage</a></code>
+- <code><a href="./src/resources/browsers/browsers.ts">BrowserVideoMemory</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">Profile</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">Tags</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">VaultReference</a></code>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.122.0",
+  "version": "0.123.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/client.ts

@@ -180,6 +180,7 @@ import {
   BrowserUpdateParams,
   BrowserUpdateResponse,
   BrowserUsage,
+  BrowserVideoMemory,
   Browsers,
   Profile,
   Tags,
@@ -1234,6 +1235,7 @@ export declare namespace Kernel {
     type BrowserReplResult as BrowserReplResult,
     type BrowserReplTextContent as BrowserReplTextContent,
     type BrowserUsage as BrowserUsage,
+    type BrowserVideoMemory as BrowserVideoMemory,
     type Profile as Profile,
     type Tags as Tags,
     type VaultReference as VaultReference,

src/resources/browser-pools.ts

@@ -517,6 +517,11 @@ export interface BrowserPoolAcquireResponse {
    */
   vaults?: Array<BrowsersAPI.VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowsersAPI.BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -585,9 +590,9 @@ export interface BrowserPoolCreateParams {
   name?: string;
 
   /**
-   * Network configuration applied to browsers in this pool. Proxy routes require
-   * proxy-v3; the pool will not provision browsers through Envoy if proxy-v3 is
-   * unavailable.
+   * Network configuration applied to browsers in this pool. Egress allowlists and
+   * proxy routes require proxy-v3; the pool will not provision browsers through
+   * Envoy if proxy-v3 is unavailable.
    */
   network?: BrowsersAPI.BrowserNetworkConfig;
 
@@ -814,9 +819,11 @@ export interface BrowserPoolUpdateParams {
    * Whether to discard all idle browsers and rebuild them immediately with the new
    * configuration. Defaults to false. Only browsers that are idle when the update
    * runs are rebuilt. A browser that is in use during the update keeps its original
-   * configuration, and if it is later released with `reuse: true` it returns to the
-   * pool with that stale configuration until it is discarded (by this flag on a
-   * later update, or by flushing the pool).
+   * configuration, except that its allowlist is reset to the current pool baseline
+   * on release or the browser is replaced. For other configuration fields, if it is
+   * later released with `reuse: true` it returns to the pool with that stale
+   * configuration until it is discarded (by this flag on a later update, or by
+   * flushing the pool).
    */
   discard_all_idle?: boolean;
 
@@ -860,10 +867,14 @@ export interface BrowserPoolUpdateParams {
    * If provided, replaces the pool's network configuration. Omit to leave the
    * existing configuration unchanged; an empty object ({}) removes it, while
    * network: {private_hosts: []} or network: {proxy_routes: []} sets an explicit
-   * empty list. Proxy routes require proxy-v3; the pool will not provision browsers
-   * through Envoy if proxy-v3 is unavailable. Only applied to browsers created in
-   * the pool after the update; browsers already in the pool keep their configuration
-   * until discarded (see discard_all_idle).
+   * empty list; allowed_hosts must be non-empty when supplied. Egress allowlists and
+   * proxy routes require proxy-v3; the pool will not provision browsers through
+   * Envoy if proxy-v3 is unavailable. Changing allowed_hosts automatically replaces
+   * idle browsers. Leased browsers retain their allowlist until release, when it is
+   * reset to the current pool baseline or the browser is replaced if it cannot
+   * safely receive that baseline. Stale browsers cannot be acquired. Other network
+   * fields only apply to browsers created after the update; existing browsers keep
+   * those fields until discarded (see discard_all_idle).
    */
   network?: BrowsersAPI.BrowserNetworkConfig;
 

src/resources/browsers/browsers.ts

@@ -349,7 +349,7 @@ export type ProfilesOffsetPagination = OffsetPagination<Profile>;
 /**
  * Memory allocated to the browser session.
  */
-export type BrowserMemory = '1GiB' | '2GiB' | '6GiB' | '8GiB' | '16GiB';
+export type BrowserMemory = '1GiB' | '2GiB' | '6GiB' | '8GiB' | '12GiB' | '16GiB';
 
 /**
  * Memory requested for a headful, non-GPU browser session.
@@ -380,8 +380,10 @@ export interface BrowserNetworkConfig {
    * processes in the browser VM that do not use the browser's proxy, are not
    * filtered, and Kernel's own control traffic is always allowed. Can be replaced or
    * removed while the session runs with PATCH /browsers/{id_or_name}, but not added
-   * to a browser created without one. Requires proxy v3. Not supported on browser
-   * pools.
+   * to a browser created without one. Supported on browser pools and their leased
+   * browsers. Per-lease changes are reset to the pool's allowlist on release. If a
+   * lessee removes the allowlist and the pool still requires one, the browser is
+   * replaced on release rather than given an allowlist again. Requires proxy v3.
    */
   allowed_hosts?: Array<string>;
 
@@ -475,8 +477,10 @@ export interface BrowserNetworkUpdate {
    * minutes during a Kernel deploy. Connections to destinations it still allows,
    * such as WebSockets, stay open. A start_url in the same request must be allowed
    * by the updated list, and is loaded only after the list takes effect. Requires a
-   * browser created with proxy v3, and not supported on pooled browsers. If the
-   * request fails, retry it: the new list may already apply to some requests.
+   * browser created with proxy v3. Supported on leased pooled browsers; the pool's
+   * allowlist is restored before reuse, or the browser is destroyed if it cannot be
+   * safely restored. If the request fails, retry it: the new list may already apply
+   * to some requests.
    */
   allowed_hosts?: Array<string> | null;
 }
@@ -670,6 +674,12 @@ export interface BrowserUsage {
   uptime_ms: number;
 }
 
+/**
+ * Video memory (VRAM) of a GPU browser session. 2GiB sessions have 4 vCPU and 6GiB
+ * memory. 4GiB sessions have 8 vCPU and 12GiB memory.
+ */
+export type BrowserVideoMemory = '2GiB' | '4GiB';
+
 /**
  * Browser profile metadata.
  */
@@ -868,6 +878,11 @@ export interface BrowserCreateResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1039,6 +1054,11 @@ export interface BrowserRetrieveResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1210,6 +1230,11 @@ export interface BrowserUpdateResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1381,6 +1406,11 @@ export interface BrowserListResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1556,6 +1586,13 @@ export interface BrowserCreateParams {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) for a GPU browser session. Requires gpu=true. Defaults to
+   * 2GiB, which comes with 4 vCPU and 6GiB memory. 4GiB comes with 8 vCPU and 12GiB
+   * memory.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -2016,6 +2053,7 @@ export declare namespace Browsers {
     type BrowserReplResult as BrowserReplResult,
     type BrowserReplTextContent as BrowserReplTextContent,
     type BrowserUsage as BrowserUsage,
+    type BrowserVideoMemory as BrowserVideoMemory,
     type Profile as Profile,
     type Tags as Tags,
     type VaultReference as VaultReference,

src/resources/browsers/index.ts

@@ -16,6 +16,7 @@ export {
   type BrowserReplResult,
   type BrowserReplTextContent,
   type BrowserUsage,
+  type BrowserVideoMemory,
   type Profile,
   type Tags,
   type VaultReference,

src/resources/browsers/telemetry.ts

@@ -47,7 +47,10 @@ export class Telemetry extends APIResource {
    * stream closes when the browser session terminates. Each event frame includes an
    * id: field containing a monotonically increasing sequence number; pass it as
    * Last-Event-ID on reconnect to resume without gaps. The event: field is never
-   * set; all frames carry JSON in the data: field. A keepalive comment frame is sent
+   * set; event frames carry JSON in the data: field. A frame with an id: field and
+   * no data: field moves Last-Event-ID past events that were not delivered, because
+   * a type filter excluded them or they could not be decoded or exceeded the size
+   * limit; SSE clients dispatch no event for it. A keepalive comment frame is sent
    * every 15 seconds when no events arrive. Returns 404 if the browser session does
    * not exist. If telemetry was not enabled on the session, the stream opens but no
    * events are delivered. Fresh connections only see new events; pass replay=all to
@@ -4996,6 +4999,17 @@ export interface TelemetryStreamParams {
    */
   replay?: string;
 
+  /**
+   * Query param: Deliver only these event types, such as captcha_solve_started or
+   * captcha_challenge_result. Repeat the parameter or pass comma-separated values
+   * for multiple types. Keepalive frames are always delivered. Filtered-out events
+   * are not sent. An id-only frame carrying the latest skipped id is sent about
+   * every 15 seconds while skipped events keep arriving, and otherwise with the next
+   * keepalive or when the stream ends, so the connection stays active and
+   * Last-Event-ID moves past them; a reconnect resumes after the skipped events.
+   */
+  type?: Array<string>;
+
   /**
    * Header param: Last event sequence number for SSE reconnection (sent by SSE
    * clients on reconnect). Takes precedence over replay when both are present, so

src/resources/index.ts

@@ -54,6 +54,7 @@ export {
   type BrowserReplResult,
   type BrowserReplTextContent,
   type BrowserUsage,
+  type BrowserVideoMemory,
   type Profile,
   type Tags,
   type VaultReference,

src/resources/invocations.ts

@@ -601,6 +601,11 @@ export namespace InvocationListBrowsersResponse {
      */
     vaults?: Array<BrowsersAPI.VaultReference>;
 
+    /**
+     * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+     */
+    video_memory?: BrowsersAPI.BrowserVideoMemory;
+
     /**
      * Initial browser window size in pixels with optional refresh rate. If omitted,
      * image defaults apply (1920x1080@25). For GPU images, the default is

src/resources/vaults/items.ts

@@ -993,14 +993,15 @@ export namespace CredentialVaultItem {
  * they choose 1Password, connect their account and request access to a login in
  * their own non-shared vault; passkeys are not supported. If they decline or that
  * path fails, collect a Kernel-hosted credential item instead. Never automatically
- * retry an uncertain 1Password request or fill. Do not use credential items for
- * credit card data. Use wallet and card item types instead. Kernel credentials
- * declare fields and may enter pending_collection. 1Password credentials either
- * reference a connected credential_account or store a supplied access token and
- * integration key encrypted on the item. They store no login values or selectors.
- * Managed auth credentials reference a managed auth connection in the same project
- * that already has a saved credential, and read it at fill time; they store no
- * values. Repeating the original creation request returns the current item without
+ * retry an uncertain 1Password request. After an uncertain fill, inspect the page
+ * to see the result of the fill. Do not use credential items for credit card data.
+ * Use wallet and card item types instead. Kernel credentials declare fields and
+ * may enter pending_collection. 1Password credentials either reference a connected
+ * credential_account or store a supplied access token and integration key
+ * encrypted on the item. They store no login values or selectors. Managed auth
+ * credentials reference a managed auth connection in the same project that already
+ * has a saved credential, and read it at fill time; they store no values.
+ * Repeating the original creation request returns the current item without
  * overwriting later state. A different request at the same key returns 409.
  */
 export interface CredentialVaultItemRequest {
@@ -1774,17 +1775,19 @@ export interface OnePasswordFillVaultItemOperationResult {
   /**
    * Kernel's outcome of the extension call. fill_submitted means the extension
    * reported submission, not website authentication. fill_failed means the extension
-   * returned a known failure and may include error_code. fill_unknown means
-   * submission may have happened without a conclusive response; it has no error_code
-   * and must not be retried in the same browser.
+   * returned a known failure and includes error_code. fill_unknown means the form
+   * may have been filled or submitted without a conclusive result; inspect the page
+   * to see the result of the fill.
    */
   status: 'fill_submitted' | 'fill_failed' | 'fill_unknown';
 
   type: '1pw_fill';
 
   /**
-   * Present only for a conclusive fill_failed response. These are allowlisted
-   * 1Password extension codes, never raw errors, secrets, or page content.
+   * Present for fill_failed, and for fill_unknown when the extension reported
+   * autosubmitFailed (it filled and submitted the form but could not confirm the
+   * fill finished). These are allowlisted 1Password extension codes, never raw
+   * errors, secrets, or page content.
    */
   error_code?: 'fillFailed' | 'autosubmitFailed' | 'noExistingCredentials' | 'authenticationFailed';
 }

src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.122.0'; // x-release-please-version
+export const VERSION = '0.123.0'; // x-release-please-version

tests/api-resources/browsers/browsers.test.ts

@@ -86,6 +86,7 @@ describe('resource browsers', () => {
           },
           timeout_seconds: 10,
           vaults: [{ id: 'id', name: 'x' }],
+          video_memory: '2GiB',
           viewport: {
             height: 800,
             width: 1280,

tests/api-resources/browsers/telemetry.test.ts

@@ -58,7 +58,11 @@ describe('resource telemetry', () => {
     await expect(
       client.browsers.telemetry.stream(
         'htzv5orfit78e1m2biiifpbv',
-        { replay: 'replay', 'Last-Event-ID': 'Last-Event-ID' },
+        {
+          replay: 'replay',
+          type: ['string'],
+          'Last-Event-ID': 'Last-Event-ID',
+        },
         { path: '/_stainless_unknown_path' },
       ),
     ).rejects.toThrow(Kernel.NotFoundError);