From e8641ebe96926b22f8874a8ff79498a4cbe7e4ed Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:34:47 +0000
Subject: [PATCH 01/12] docs(api): clarify reuse/discard_all_idle pool config
 staleness

---
 .stats.yml                                    |  4 +--
 src/kernel/resources/browser_pools.py         | 26 ++++++++++++++-----
 .../types/browser_pool_release_params.py      |  5 +++-
 .../types/browser_pool_update_params.py       | 10 ++++---
 4 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 0297d26a..40adb553 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-ebbe079bb2542625826422afd876a3e8b499c579cf45efc5fd50e7982d34df7d.yml
-openapi_spec_hash: db850b61a0d71fe9f4b642df8782d7ae
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-83323f87ab825547b6cd11caa46e2643ebb0a68bbd326d4e07ccab970638fc03.yml
+openapi_spec_hash: 69ed04a66b4ef68e97f7bdc07dfe6df2
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/resources/browser_pools.py b/src/kernel/resources/browser_pools.py
index 6df691be..ea9be13f 100644
--- a/src/kernel/resources/browser_pools.py
+++ b/src/kernel/resources/browser_pools.py
@@ -249,8 +249,12 @@ def update(
               Blocked: kernel-managed policies (extensions, proxy, CDP/automation). See
               https://chromeenterprise.google/policies/
 
-          discard_all_idle: Whether to discard all idle browsers and rebuild the pool immediately. Defaults
-              to false.
+          discard_all_idle: Whether to discard all idle browsers and rebuild them immediately with the new
+              configuration. Defaults to false. Only browsers that are idle when the update
+              runs are rebuilt. A browser that is in use during the update keeps its original
+              configuration, and if it is later released with `reuse: true` it returns to the
+              pool with that stale configuration until it is discarded (by this flag on a
+              later update, or by flushing the pool).
 
           extensions: List of browser extensions to load into the session. Provide each by id or name.
 
@@ -554,7 +558,10 @@ def release(
           session_id: Browser session ID to release back to the pool
 
           reuse: Whether to reuse the browser instance or destroy it and create a new one.
-              Defaults to true.
+              Defaults to true. A reused browser keeps the configuration it was created with,
+              so it does not pick up pool configuration changes made while it was in use.
+              Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+              current configuration.
 
           extra_headers: Send extra headers
 
@@ -797,8 +804,12 @@ async def update(
               Blocked: kernel-managed policies (extensions, proxy, CDP/automation). See
               https://chromeenterprise.google/policies/
 
-          discard_all_idle: Whether to discard all idle browsers and rebuild the pool immediately. Defaults
-              to false.
+          discard_all_idle: Whether to discard all idle browsers and rebuild them immediately with the new
+              configuration. Defaults to false. Only browsers that are idle when the update
+              runs are rebuilt. A browser that is in use during the update keeps its original
+              configuration, and if it is later released with `reuse: true` it returns to the
+              pool with that stale configuration until it is discarded (by this flag on a
+              later update, or by flushing the pool).
 
           extensions: List of browser extensions to load into the session. Provide each by id or name.
 
@@ -1102,7 +1113,10 @@ async def release(
           session_id: Browser session ID to release back to the pool
 
           reuse: Whether to reuse the browser instance or destroy it and create a new one.
-              Defaults to true.
+              Defaults to true. A reused browser keeps the configuration it was created with,
+              so it does not pick up pool configuration changes made while it was in use.
+              Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+              current configuration.
 
           extra_headers: Send extra headers
 
diff --git a/src/kernel/types/browser_pool_release_params.py b/src/kernel/types/browser_pool_release_params.py
index 104b0b0c..944e734b 100644
--- a/src/kernel/types/browser_pool_release_params.py
+++ b/src/kernel/types/browser_pool_release_params.py
@@ -14,5 +14,8 @@ class BrowserPoolReleaseParams(TypedDict, total=False):
     reuse: bool
     """Whether to reuse the browser instance or destroy it and create a new one.
 
-    Defaults to true.
+    Defaults to true. A reused browser keeps the configuration it was created with,
+    so it does not pick up pool configuration changes made while it was in use.
+    Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+    current configuration.
     """
diff --git a/src/kernel/types/browser_pool_update_params.py b/src/kernel/types/browser_pool_update_params.py
index fa860f6e..963de02c 100644
--- a/src/kernel/types/browser_pool_update_params.py
+++ b/src/kernel/types/browser_pool_update_params.py
@@ -21,9 +21,13 @@ class BrowserPoolUpdateParams(TypedDict, total=False):
     """
 
     discard_all_idle: bool
-    """Whether to discard all idle browsers and rebuild the pool immediately.
-
-    Defaults to false.
+    """
+    Whether to discard all idle browsers and rebuild them immediately with the new
+    configuration. Defaults to false. Only browsers that are idle when the update
+    runs are rebuilt. A browser that is in use during the update keeps its original
+    configuration, and if it is later released with `reuse: true` it returns to the
+    pool with that stale configuration until it is discarded (by this flag on a
+    later update, or by flushing the pool).
     """
 
     extensions: Iterable[BrowserExtension]

From 51d713b92b4c0ed0c2420ea2e128568530a81a14 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 20:14:56 +0000
Subject: [PATCH 02/12] feat: Document env var redaction on deployment and app
 reads

---
 .stats.yml                                       | 4 ++--
 src/kernel/types/app_list_response.py            | 7 ++++++-
 src/kernel/types/deployment_create_response.py   | 7 ++++++-
 src/kernel/types/deployment_follow_response.py   | 5 ++++-
 src/kernel/types/deployment_list_response.py     | 7 ++++++-
 src/kernel/types/deployment_retrieve_response.py | 7 ++++++-
 src/kernel/types/deployment_state_event.py       | 7 ++++++-
 7 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 40adb553..34f90982 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-83323f87ab825547b6cd11caa46e2643ebb0a68bbd326d4e07ccab970638fc03.yml
-openapi_spec_hash: 69ed04a66b4ef68e97f7bdc07dfe6df2
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-89a500b26fe8126183d55aaca53f5615c6a25561d8e01e907f4998239ccc7a0b.yml
+openapi_spec_hash: 50236a5e713d5424ca35c0883926b0a5
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/types/app_list_response.py b/src/kernel/types/app_list_response.py
index 338f506d..91ad648e 100644
--- a/src/kernel/types/app_list_response.py
+++ b/src/kernel/types/app_list_response.py
@@ -25,7 +25,12 @@ class AppListResponse(BaseModel):
     """Deployment ID"""
 
     env_vars: Dict[str, str]
-    """Environment variables configured for this app version"""
+    """Environment variables configured for this app version.
+
+    Values are redacted for API key, OAuth, and managed-auth callers, which receive
+    every key with an empty string value. Only dashboard sessions receive the actual
+    values.
+    """
 
     region: Literal["aws.us-east-1a"]
     """Deployment region code"""
diff --git a/src/kernel/types/deployment_create_response.py b/src/kernel/types/deployment_create_response.py
index 5746c97b..17d17b59 100644
--- a/src/kernel/types/deployment_create_response.py
+++ b/src/kernel/types/deployment_create_response.py
@@ -28,7 +28,12 @@ class DeploymentCreateResponse(BaseModel):
     """Relative path to the application entrypoint"""
 
     env_vars: Optional[Dict[str, str]] = None
-    """Environment variables configured for this deployment"""
+    """Environment variables configured for this deployment.
+
+    Values are redacted for API key, OAuth, and managed-auth callers, which receive
+    every key with an empty string value. Only dashboard sessions receive the actual
+    values.
+    """
 
     status_reason: Optional[str] = None
     """Status reason"""
diff --git a/src/kernel/types/deployment_follow_response.py b/src/kernel/types/deployment_follow_response.py
index d6de2223..36087a67 100644
--- a/src/kernel/types/deployment_follow_response.py
+++ b/src/kernel/types/deployment_follow_response.py
@@ -40,7 +40,10 @@ class AppVersionSummaryEvent(BaseModel):
     """Version label for the application"""
 
     env_vars: Optional[Dict[str, str]] = None
-    """Environment variables configured for this app version"""
+    """Environment variables configured for this app version.
+
+    Not currently populated on streamed app_version_summary events.
+    """
 
 
 DeploymentFollowResponse: TypeAlias = Annotated[
diff --git a/src/kernel/types/deployment_list_response.py b/src/kernel/types/deployment_list_response.py
index d7719d48..5806bdaf 100644
--- a/src/kernel/types/deployment_list_response.py
+++ b/src/kernel/types/deployment_list_response.py
@@ -28,7 +28,12 @@ class DeploymentListResponse(BaseModel):
     """Relative path to the application entrypoint"""
 
     env_vars: Optional[Dict[str, str]] = None
-    """Environment variables configured for this deployment"""
+    """Environment variables configured for this deployment.
+
+    Values are redacted for API key, OAuth, and managed-auth callers, which receive
+    every key with an empty string value. Only dashboard sessions receive the actual
+    values.
+    """
 
     status_reason: Optional[str] = None
     """Status reason"""
diff --git a/src/kernel/types/deployment_retrieve_response.py b/src/kernel/types/deployment_retrieve_response.py
index 3601c864..addcad4a 100644
--- a/src/kernel/types/deployment_retrieve_response.py
+++ b/src/kernel/types/deployment_retrieve_response.py
@@ -28,7 +28,12 @@ class DeploymentRetrieveResponse(BaseModel):
     """Relative path to the application entrypoint"""
 
     env_vars: Optional[Dict[str, str]] = None
-    """Environment variables configured for this deployment"""
+    """Environment variables configured for this deployment.
+
+    Values are redacted for API key, OAuth, and managed-auth callers, which receive
+    every key with an empty string value. Only dashboard sessions receive the actual
+    values.
+    """
 
     status_reason: Optional[str] = None
     """Status reason"""
diff --git a/src/kernel/types/deployment_state_event.py b/src/kernel/types/deployment_state_event.py
index cc221c77..dce183a7 100644
--- a/src/kernel/types/deployment_state_event.py
+++ b/src/kernel/types/deployment_state_event.py
@@ -28,7 +28,12 @@ class Deployment(BaseModel):
     """Relative path to the application entrypoint"""
 
     env_vars: Optional[Dict[str, str]] = None
-    """Environment variables configured for this deployment"""
+    """Environment variables configured for this deployment.
+
+    Values are redacted for API key, OAuth, and managed-auth callers, which receive
+    every key with an empty string value. Only dashboard sessions receive the actual
+    values.
+    """
 
     status_reason: Optional[str] = None
     """Status reason"""

From 1a563dd0fa7f183dd9c57286b721483085cd3423 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 18:01:42 +0000
Subject: [PATCH 03/12] codegen metadata

---
 .stats.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 34f90982..199caa16 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-89a500b26fe8126183d55aaca53f5615c6a25561d8e01e907f4998239ccc7a0b.yml
-openapi_spec_hash: 50236a5e713d5424ca35c0883926b0a5
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-073bade6de836ae1cf0cb3f8551cc5c6635f98649d7cf5059ef6819e9ce0f508.yml
+openapi_spec_hash: e84f887c72b5c7335158b706e4218bc7
 config_hash: 06186eb40e0058a2a87ac251fc07415d

From 482f9209f956e5615bdbaa6ec9c58081df56587b Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 21:27:36 +0000
Subject: [PATCH 04/12] feat: Reject API key self-deletion

---
 .stats.yml                       |  4 ++--
 src/kernel/resources/api_keys.py | 12 ++++++++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 199caa16..02a158e4 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-073bade6de836ae1cf0cb3f8551cc5c6635f98649d7cf5059ef6819e9ce0f508.yml
-openapi_spec_hash: e84f887c72b5c7335158b706e4218bc7
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-bd00e13bd6d37c150009e612ebeb6ef03d050610f80aaed517e283812c7b9ba9.yml
+openapi_spec_hash: 08c7c031877d6b882ff291b389937028
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/resources/api_keys.py b/src/kernel/resources/api_keys.py
index da28774d..502e8897 100644
--- a/src/kernel/resources/api_keys.py
+++ b/src/kernel/resources/api_keys.py
@@ -266,8 +266,10 @@ def delete(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> None:
-        """
-        Delete an API key.
+        """Delete an API key.
+
+        A key cannot delete itself; use a different key to delete
+        this one.
 
         Args:
           extra_headers: Send extra headers
@@ -575,8 +577,10 @@ async def delete(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> None:
-        """
-        Delete an API key.
+        """Delete an API key.
+
+        A key cannot delete itself; use a different key to delete
+        this one.
 
         Args:
           extra_headers: Send extra headers

From b266775497fec10224e965c787c146494eecdae8 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 21:51:33 +0000
Subject: [PATCH 05/12] feat: Store and return a sha256 checksum for uploaded
 extensions

---
 .stats.yml                                    | 4 ++--
 src/kernel/types/extension_get_response.py    | 9 +++++++++
 src/kernel/types/extension_list_response.py   | 9 +++++++++
 src/kernel/types/extension_upload_response.py | 9 +++++++++
 4 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 02a158e4..06a81919 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-bd00e13bd6d37c150009e612ebeb6ef03d050610f80aaed517e283812c7b9ba9.yml
-openapi_spec_hash: 08c7c031877d6b882ff291b389937028
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-e123113e7c86e8a61c763f0078adec5b0a7df621f2c31824e8f553331cf7a624.yml
+openapi_spec_hash: 940fb94967b6cb5e13daef6161d3abbf
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/types/extension_get_response.py b/src/kernel/types/extension_get_response.py
index 0143e623..a4d10b1f 100644
--- a/src/kernel/types/extension_get_response.py
+++ b/src/kernel/types/extension_get_response.py
@@ -20,6 +20,15 @@ class ExtensionGetResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
+    checksum: Optional[str] = None
+    """
+    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+    extension archive bytes. This is not a normalized checksum of the extension
+    contents; archive metadata, file ordering, and compression can change the
+    checksum for otherwise identical contents. Omitted for legacy rows and
+    server-repackaged Chrome Web Store extensions.
+    """
+
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 
diff --git a/src/kernel/types/extension_list_response.py b/src/kernel/types/extension_list_response.py
index 6bb33561..d7d0ea0d 100644
--- a/src/kernel/types/extension_list_response.py
+++ b/src/kernel/types/extension_list_response.py
@@ -20,6 +20,15 @@ class ExtensionListResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
+    checksum: Optional[str] = None
+    """
+    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+    extension archive bytes. This is not a normalized checksum of the extension
+    contents; archive metadata, file ordering, and compression can change the
+    checksum for otherwise identical contents. Omitted for legacy rows and
+    server-repackaged Chrome Web Store extensions.
+    """
+
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 
diff --git a/src/kernel/types/extension_upload_response.py b/src/kernel/types/extension_upload_response.py
index 068b25dd..b44390d4 100644
--- a/src/kernel/types/extension_upload_response.py
+++ b/src/kernel/types/extension_upload_response.py
@@ -20,6 +20,15 @@ class ExtensionUploadResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
+    checksum: Optional[str] = None
+    """
+    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+    extension archive bytes. This is not a normalized checksum of the extension
+    contents; archive metadata, file ordering, and compression can change the
+    checksum for otherwise identical contents. Omitted for legacy rows and
+    server-repackaged Chrome Web Store extensions.
+    """
+
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 

From 74dbc54d4d8d5b330f74985227fa09f7569457a7 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:19:51 +0000
Subject: [PATCH 06/12] =?UTF-8?q?feat:=20Revert=20"Store=20and=20return=20?=
 =?UTF-8?q?a=20sha256=20checksum=20for=20uploaded=20extensions=20(#?=
 =?UTF-8?q?=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .stats.yml                                    | 4 ++--
 src/kernel/types/extension_get_response.py    | 9 ---------
 src/kernel/types/extension_list_response.py   | 9 ---------
 src/kernel/types/extension_upload_response.py | 9 ---------
 4 files changed, 2 insertions(+), 29 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 06a81919..70c2c4fc 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-e123113e7c86e8a61c763f0078adec5b0a7df621f2c31824e8f553331cf7a624.yml
-openapi_spec_hash: 940fb94967b6cb5e13daef6161d3abbf
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4395690aa03bf5e2482d60132f7eebdbf88265af3d53098789f6c2f3c623d769.yml
+openapi_spec_hash: ad7c56d655a6e3899532caa4588a02b7
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/types/extension_get_response.py b/src/kernel/types/extension_get_response.py
index a4d10b1f..0143e623 100644
--- a/src/kernel/types/extension_get_response.py
+++ b/src/kernel/types/extension_get_response.py
@@ -20,15 +20,6 @@ class ExtensionGetResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
-    checksum: Optional[str] = None
-    """
-    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
-    extension archive bytes. This is not a normalized checksum of the extension
-    contents; archive metadata, file ordering, and compression can change the
-    checksum for otherwise identical contents. Omitted for legacy rows and
-    server-repackaged Chrome Web Store extensions.
-    """
-
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 
diff --git a/src/kernel/types/extension_list_response.py b/src/kernel/types/extension_list_response.py
index d7d0ea0d..6bb33561 100644
--- a/src/kernel/types/extension_list_response.py
+++ b/src/kernel/types/extension_list_response.py
@@ -20,15 +20,6 @@ class ExtensionListResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
-    checksum: Optional[str] = None
-    """
-    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
-    extension archive bytes. This is not a normalized checksum of the extension
-    contents; archive metadata, file ordering, and compression can change the
-    checksum for otherwise identical contents. Omitted for legacy rows and
-    server-repackaged Chrome Web Store extensions.
-    """
-
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 
diff --git a/src/kernel/types/extension_upload_response.py b/src/kernel/types/extension_upload_response.py
index b44390d4..068b25dd 100644
--- a/src/kernel/types/extension_upload_response.py
+++ b/src/kernel/types/extension_upload_response.py
@@ -20,15 +20,6 @@ class ExtensionUploadResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
-    checksum: Optional[str] = None
-    """
-    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
-    extension archive bytes. This is not a normalized checksum of the extension
-    contents; archive metadata, file ordering, and compression can change the
-    checksum for otherwise identical contents. Omitted for legacy rows and
-    server-repackaged Chrome Web Store extensions.
-    """
-
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 

From 7c29a16aede94b3ff3752d894d2d609b547d3554 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 15:31:22 +0000
Subject: [PATCH 07/12] codegen metadata

---
 .stats.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 70c2c4fc..2c231f14 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4395690aa03bf5e2482d60132f7eebdbf88265af3d53098789f6c2f3c623d769.yml
-openapi_spec_hash: ad7c56d655a6e3899532caa4588a02b7
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f6795e5d85e37b74f59876434c74b598e34171f99bc598c85b789abbb60614f1.yml
+openapi_spec_hash: 98e86fcbf0710a693bb1e03170ca85c3
 config_hash: 06186eb40e0058a2a87ac251fc07415d

From 430c07fc2bfd5ab80fe25cc4677b34729bf4b4ee Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:42:38 +0000
Subject: [PATCH 08/12] feat: Auto-flush pools when a managed auth profile
 re-authenticates

---
 .stats.yml                                    |  4 +-
 src/kernel/resources/browser_pools.py         | 76 ++++++++++++-------
 src/kernel/types/browser_pool.py              | 30 ++++----
 .../types/browser_pool_create_params.py       | 30 ++++----
 .../types/browser_pool_update_params.py       | 30 ++++----
 tests/api_resources/test_browser_pools.py     |  4 +
 6 files changed, 107 insertions(+), 67 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 2c231f14..d888de6d 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f6795e5d85e37b74f59876434c74b598e34171f99bc598c85b789abbb60614f1.yml
-openapi_spec_hash: 98e86fcbf0710a693bb1e03170ca85c3
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-58ad412d62b3d94e3258c911d7028716d71191358ff769ce494c4b2d87027254.yml
+openapi_spec_hash: 45d710b7d2a9beadff021514bb997ba1
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/resources/browser_pools.py b/src/kernel/resources/browser_pools.py
index ea9be13f..12239d00 100644
--- a/src/kernel/resources/browser_pools.py
+++ b/src/kernel/resources/browser_pools.py
@@ -69,6 +69,7 @@ def create(
         name: str | Omit = omit,
         profile: browser_pool_create_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         timeout_seconds: int | Omit = omit,
@@ -110,16 +111,19 @@ def create(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           start_url: Optional URL to navigate to when a new browser is warmed into the pool.
               Best-effort: failures to navigate do not fail pool fill. Only applied to
               newly-warmed browsers; browsers reused via release/acquire keep whatever URL the
@@ -166,6 +170,7 @@ def create(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "start_url": start_url,
                     "stealth": stealth,
                     "timeout_seconds": timeout_seconds,
@@ -225,6 +230,7 @@ def update(
         name: str | Omit = omit,
         profile: browser_pool_update_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         size: int | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
@@ -241,7 +247,9 @@ def update(
 
         As with creation,
         save_changes on the pool profile is ignored (not rejected); pooled browsers
-        never persist changes back to the profile.
+        never persist changes back to the profile. To clear the profile reference, send
+        `profile: { "id": "" }`. Clearing the profile also disables
+        `refresh_on_profile_update`.
 
         Args:
           chrome_policy: Custom Chrome enterprise policy overrides applied to all browsers in this pool.
@@ -269,16 +277,19 @@ def update(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           size: Number of browsers to maintain in the pool. The maximum size is determined by
               your organization's pooled sessions limit (the sum of all pool sizes cannot
               exceed your limit).
@@ -331,6 +342,7 @@ def update(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "size": size,
                     "start_url": start_url,
                     "stealth": stealth,
@@ -624,6 +636,7 @@ async def create(
         name: str | Omit = omit,
         profile: browser_pool_create_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         timeout_seconds: int | Omit = omit,
@@ -665,16 +678,19 @@ async def create(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           start_url: Optional URL to navigate to when a new browser is warmed into the pool.
               Best-effort: failures to navigate do not fail pool fill. Only applied to
               newly-warmed browsers; browsers reused via release/acquire keep whatever URL the
@@ -721,6 +737,7 @@ async def create(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "start_url": start_url,
                     "stealth": stealth,
                     "timeout_seconds": timeout_seconds,
@@ -780,6 +797,7 @@ async def update(
         name: str | Omit = omit,
         profile: browser_pool_update_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         size: int | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
@@ -796,7 +814,9 @@ async def update(
 
         As with creation,
         save_changes on the pool profile is ignored (not rejected); pooled browsers
-        never persist changes back to the profile.
+        never persist changes back to the profile. To clear the profile reference, send
+        `profile: { "id": "" }`. Clearing the profile also disables
+        `refresh_on_profile_update`.
 
         Args:
           chrome_policy: Custom Chrome enterprise policy overrides applied to all browsers in this pool.
@@ -824,16 +844,19 @@ async def update(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           size: Number of browsers to maintain in the pool. The maximum size is determined by
               your organization's pooled sessions limit (the sum of all pool sizes cannot
               exceed your limit).
@@ -886,6 +909,7 @@ async def update(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "size": size,
                     "start_url": start_url,
                     "stealth": stealth,
diff --git a/src/kernel/types/browser_pool.py b/src/kernel/types/browser_pool.py
index 0b77264c..a407009c 100644
--- a/src/kernel/types/browser_pool.py
+++ b/src/kernel/types/browser_pool.py
@@ -11,13 +11,12 @@
 
 
 class BrowserPoolConfigProfile(BaseModel):
-    """Profile selection for browsers in a pool.
+    """Profile configuration for browsers in a pool.
 
-    Provide either id or name. The matching profile is
-    loaded into every browser in the pool. Profiles must be created beforehand. Unlike single
-    browser sessions, pools load the profile read-only and never persist changes back to it, so
-    save_changes is omitted here. Any save_changes value sent on a pool profile is silently
-    ignored rather than rejected, so callers reusing a single-session profile object will not error.
+    Provide either id or name. Profiles must
+    be created beforehand. Unlike single browser sessions, pools load the profile read-only
+    and never persist changes back to it, so save_changes is omitted here. Any save_changes
+    value sent on a pool profile is silently ignored rather than rejected.
     """
 
     id: Optional[str] = None
@@ -74,14 +73,12 @@ class BrowserPoolConfig(BaseModel):
     """Optional name for the browser pool. Must be unique within the project."""
 
     profile: Optional[BrowserPoolConfigProfile] = None
-    """Profile selection for browsers in a pool.
+    """Profile configuration for browsers in a pool.
 
-    Provide either id or name. The matching profile is loaded into every browser in
-    the pool. Profiles must be created beforehand. Unlike single browser sessions,
-    pools load the profile read-only and never persist changes back to it, so
-    save_changes is omitted here. Any save_changes value sent on a pool profile is
-    silently ignored rather than rejected, so callers reusing a single-session
-    profile object will not error.
+    Provide either id or name. Profiles must be created beforehand. Unlike single
+    browser sessions, pools load the profile read-only and never persist changes
+    back to it, so save_changes is omitted here. Any save_changes value sent on a
+    pool profile is silently ignored rather than rejected.
     """
 
     proxy_id: Optional[str] = None
@@ -90,6 +87,13 @@ class BrowserPoolConfig(BaseModel):
     Must reference a proxy in the same project as the browser session.
     """
 
+    refresh_on_profile_update: Optional[bool] = None
+    """
+    When true, flush idle browsers when the profile the pool uses is updated, so
+    pool browsers pick up the latest profile data. Requires a profile to be set on
+    the pool.
+    """
+
     start_url: Optional[str] = None
     """Optional URL to navigate to when a new browser is warmed into the pool.
 
diff --git a/src/kernel/types/browser_pool_create_params.py b/src/kernel/types/browser_pool_create_params.py
index 3774c107..5d4d9760 100644
--- a/src/kernel/types/browser_pool_create_params.py
+++ b/src/kernel/types/browser_pool_create_params.py
@@ -53,14 +53,12 @@ class BrowserPoolCreateParams(TypedDict, total=False):
     """Optional name for the browser pool. Must be unique within the project."""
 
     profile: Profile
-    """Profile selection for browsers in a pool.
+    """Profile configuration for browsers in a pool.
 
-    Provide either id or name. The matching profile is loaded into every browser in
-    the pool. Profiles must be created beforehand. Unlike single browser sessions,
-    pools load the profile read-only and never persist changes back to it, so
-    save_changes is omitted here. Any save_changes value sent on a pool profile is
-    silently ignored rather than rejected, so callers reusing a single-session
-    profile object will not error.
+    Provide either id or name. Profiles must be created beforehand. Unlike single
+    browser sessions, pools load the profile read-only and never persist changes
+    back to it, so save_changes is omitted here. Any save_changes value sent on a
+    pool profile is silently ignored rather than rejected.
     """
 
     proxy_id: str
@@ -69,6 +67,13 @@ class BrowserPoolCreateParams(TypedDict, total=False):
     Must reference a proxy in the same project as the browser session.
     """
 
+    refresh_on_profile_update: bool
+    """
+    When true, flush idle browsers when the profile the pool uses is updated, so
+    pool browsers pick up the latest profile data. Requires a profile to be set on
+    the pool.
+    """
+
     start_url: str
     """Optional URL to navigate to when a new browser is warmed into the pool.
 
@@ -108,13 +113,12 @@ class BrowserPoolCreateParams(TypedDict, total=False):
 
 
 class Profile(TypedDict, total=False):
-    """Profile selection for browsers in a pool.
+    """Profile configuration for browsers in a pool.
 
-    Provide either id or name. The matching profile is
-    loaded into every browser in the pool. Profiles must be created beforehand. Unlike single
-    browser sessions, pools load the profile read-only and never persist changes back to it, so
-    save_changes is omitted here. Any save_changes value sent on a pool profile is silently
-    ignored rather than rejected, so callers reusing a single-session profile object will not error.
+    Provide either id or name. Profiles must
+    be created beforehand. Unlike single browser sessions, pools load the profile read-only
+    and never persist changes back to it, so save_changes is omitted here. Any save_changes
+    value sent on a pool profile is silently ignored rather than rejected.
     """
 
     id: str
diff --git a/src/kernel/types/browser_pool_update_params.py b/src/kernel/types/browser_pool_update_params.py
index 963de02c..d504e29d 100644
--- a/src/kernel/types/browser_pool_update_params.py
+++ b/src/kernel/types/browser_pool_update_params.py
@@ -56,14 +56,12 @@ class BrowserPoolUpdateParams(TypedDict, total=False):
     """Optional name for the browser pool. Must be unique within the project."""
 
     profile: Profile
-    """Profile selection for browsers in a pool.
+    """Profile configuration for browsers in a pool.
 
-    Provide either id or name. The matching profile is loaded into every browser in
-    the pool. Profiles must be created beforehand. Unlike single browser sessions,
-    pools load the profile read-only and never persist changes back to it, so
-    save_changes is omitted here. Any save_changes value sent on a pool profile is
-    silently ignored rather than rejected, so callers reusing a single-session
-    profile object will not error.
+    Provide either id or name. Profiles must be created beforehand. Unlike single
+    browser sessions, pools load the profile read-only and never persist changes
+    back to it, so save_changes is omitted here. Any save_changes value sent on a
+    pool profile is silently ignored rather than rejected.
     """
 
     proxy_id: str
@@ -72,6 +70,13 @@ class BrowserPoolUpdateParams(TypedDict, total=False):
     Must reference a proxy in the same project as the browser session.
     """
 
+    refresh_on_profile_update: bool
+    """
+    When true, flush idle browsers when the profile the pool uses is updated, so
+    pool browsers pick up the latest profile data. Requires a profile to be set on
+    the pool.
+    """
+
     size: int
     """Number of browsers to maintain in the pool.
 
@@ -118,13 +123,12 @@ class BrowserPoolUpdateParams(TypedDict, total=False):
 
 
 class Profile(TypedDict, total=False):
-    """Profile selection for browsers in a pool.
+    """Profile configuration for browsers in a pool.
 
-    Provide either id or name. The matching profile is
-    loaded into every browser in the pool. Profiles must be created beforehand. Unlike single
-    browser sessions, pools load the profile read-only and never persist changes back to it, so
-    save_changes is omitted here. Any save_changes value sent on a pool profile is silently
-    ignored rather than rejected, so callers reusing a single-session profile object will not error.
+    Provide either id or name. Profiles must
+    be created beforehand. Unlike single browser sessions, pools load the profile read-only
+    and never persist changes back to it, so save_changes is omitted here. Any save_changes
+    value sent on a pool profile is silently ignored rather than rejected.
     """
 
     id: str
diff --git a/tests/api_resources/test_browser_pools.py b/tests/api_resources/test_browser_pools.py
index c7e8bdb4..b7ca39a4 100644
--- a/tests/api_resources/test_browser_pools.py
+++ b/tests/api_resources/test_browser_pools.py
@@ -50,6 +50,7 @@ def test_method_create_with_all_params(self, client: Kernel) -> None:
                 "name": "name",
             },
             proxy_id="proxy_id",
+            refresh_on_profile_update=True,
             start_url="https://example.com",
             stealth=True,
             timeout_seconds=10,
@@ -159,6 +160,7 @@ def test_method_update_with_all_params(self, client: Kernel) -> None:
                 "name": "name",
             },
             proxy_id="proxy_id",
+            refresh_on_profile_update=True,
             size=10,
             start_url="https://example.com",
             stealth=True,
@@ -484,6 +486,7 @@ async def test_method_create_with_all_params(self, async_client: AsyncKernel) ->
                 "name": "name",
             },
             proxy_id="proxy_id",
+            refresh_on_profile_update=True,
             start_url="https://example.com",
             stealth=True,
             timeout_seconds=10,
@@ -593,6 +596,7 @@ async def test_method_update_with_all_params(self, async_client: AsyncKernel) ->
                 "name": "name",
             },
             proxy_id="proxy_id",
+            refresh_on_profile_update=True,
             size=10,
             start_url="https://example.com",
             stealth=True,

From 58133f5c1905483481e14524ed65aee48f0bbc32 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:59:25 +0000
Subject: [PATCH 09/12] codegen metadata

---
 .stats.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index d888de6d..9c64d8cf 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-58ad412d62b3d94e3258c911d7028716d71191358ff769ce494c4b2d87027254.yml
-openapi_spec_hash: 45d710b7d2a9beadff021514bb997ba1
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4655211f0824a1eb5d534731697ea215c19e769e3c63ac61ca306c7a3140b0b4.yml
+openapi_spec_hash: 0a440e663f1704d4b9a3a3ac5fa75ffb
 config_hash: 06186eb40e0058a2a87ac251fc07415d

From 98cfb2835be3d321799bbfd0400e1bb59b39b218 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 19:54:52 +0000
Subject: [PATCH 10/12] feat: Store and return a sha256 checksum for uploaded
 extensions (reland)

---
 .stats.yml                                    | 4 ++--
 src/kernel/types/extension_get_response.py    | 9 +++++++++
 src/kernel/types/extension_list_response.py   | 9 +++++++++
 src/kernel/types/extension_upload_response.py | 9 +++++++++
 4 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 9c64d8cf..1d73bab6 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-4655211f0824a1eb5d534731697ea215c19e769e3c63ac61ca306c7a3140b0b4.yml
-openapi_spec_hash: 0a440e663f1704d4b9a3a3ac5fa75ffb
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f040d3f5c26d6e0d312206b294d3745b272e26b883e7d704f6b4c45dd438cd01.yml
+openapi_spec_hash: 56f4918d2e3f8d717ffe3643a20feb96
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/types/extension_get_response.py b/src/kernel/types/extension_get_response.py
index 0143e623..a4d10b1f 100644
--- a/src/kernel/types/extension_get_response.py
+++ b/src/kernel/types/extension_get_response.py
@@ -20,6 +20,15 @@ class ExtensionGetResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
+    checksum: Optional[str] = None
+    """
+    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+    extension archive bytes. This is not a normalized checksum of the extension
+    contents; archive metadata, file ordering, and compression can change the
+    checksum for otherwise identical contents. Omitted for legacy rows and
+    server-repackaged Chrome Web Store extensions.
+    """
+
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 
diff --git a/src/kernel/types/extension_list_response.py b/src/kernel/types/extension_list_response.py
index 6bb33561..d7d0ea0d 100644
--- a/src/kernel/types/extension_list_response.py
+++ b/src/kernel/types/extension_list_response.py
@@ -20,6 +20,15 @@ class ExtensionListResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
+    checksum: Optional[str] = None
+    """
+    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+    extension archive bytes. This is not a normalized checksum of the extension
+    contents; archive metadata, file ordering, and compression can change the
+    checksum for otherwise identical contents. Omitted for legacy rows and
+    server-repackaged Chrome Web Store extensions.
+    """
+
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 
diff --git a/src/kernel/types/extension_upload_response.py b/src/kernel/types/extension_upload_response.py
index 068b25dd..b44390d4 100644
--- a/src/kernel/types/extension_upload_response.py
+++ b/src/kernel/types/extension_upload_response.py
@@ -20,6 +20,15 @@ class ExtensionUploadResponse(BaseModel):
     size_bytes: int
     """Size of the extension archive in bytes"""
 
+    checksum: Optional[str] = None
+    """
+    SHA-256 checksum, encoded as lowercase hexadecimal, of the exact uploaded
+    extension archive bytes. This is not a normalized checksum of the extension
+    contents; archive metadata, file ordering, and compression can change the
+    checksum for otherwise identical contents. Omitted for legacy rows and
+    server-repackaged Chrome Web Store extensions.
+    """
+
     last_used_at: Optional[datetime] = None
     """Timestamp when the extension was last used"""
 

From 56876e9a49fca34ec34b58ea8f5f85130c0c0315 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 21:17:16 +0000
Subject: [PATCH 11/12] feat: Expose resolved profile_id and extension_ids on
 browser pool reads

---
 .stats.yml                       |  4 ++--
 src/kernel/types/browser_pool.py | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 1d73bab6..f8ffb2dd 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f040d3f5c26d6e0d312206b294d3745b272e26b883e7d704f6b4c45dd438cd01.yml
-openapi_spec_hash: 56f4918d2e3f8d717ffe3643a20feb96
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f0486d0b8e34ddf8ba34e36ff97856cf973e0797e021ff621e04e4840970966e.yml
+openapi_spec_hash: 12a71ce5ac80fc65f6a8779f0ca29223
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/types/browser_pool.py b/src/kernel/types/browser_pool.py
index a407009c..78860923 100644
--- a/src/kernel/types/browser_pool.py
+++ b/src/kernel/types/browser_pool.py
@@ -150,5 +150,21 @@ class BrowserPool(BaseModel):
     created_at: datetime
     """Timestamp when the browser pool was created"""
 
+    extension_ids: List[str]
+    """Resolved extension IDs attached to the pool, in configured load order.
+
+    Empty when no extensions are attached. Authoritative for programmatic consumers;
+    the extensions inside `browser_pool_config` reflect the configured selector
+    (echoed as sent on create).
+    """
+
     name: Optional[str] = None
     """Browser pool name, if set"""
+
+    profile_id: Optional[str] = None
+    """Resolved profile ID the pool is attached to.
+
+    Omitted when no profile is attached. Authoritative for programmatic consumers;
+    the profile inside `browser_pool_config` reflects the configured selector
+    (echoed as sent on create).
+    """

From 6b10d54b989d8794fb426dd62ee641679a59149c Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 21:17:43 +0000
Subject: [PATCH 12/12] release: 0.75.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 19 +++++++++++++++++++
 pyproject.toml                |  2 +-
 src/kernel/_version.py        |  2 +-
 4 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 192d2cdd..1cfe7eb3 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.74.0"
+  ".": "0.75.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 66e9f601..77fec02e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.75.0 (2026-07-08)
+
+Full Changelog: [v0.74.0...v0.75.0](https://github.com/kernel/kernel-python-sdk/compare/v0.74.0...v0.75.0)
+
+### Features
+
+* Auto-flush pools when a managed auth profile re-authenticates ([430c07f](https://github.com/kernel/kernel-python-sdk/commit/430c07fc2bfd5ab80fe25cc4677b34729bf4b4ee))
+* Document env var redaction on deployment and app reads ([51d713b](https://github.com/kernel/kernel-python-sdk/commit/51d713b92b4c0ed0c2420ea2e128568530a81a14))
+* Expose resolved profile_id and extension_ids on browser pool reads ([56876e9](https://github.com/kernel/kernel-python-sdk/commit/56876e9a49fca34ec34b58ea8f5f85130c0c0315))
+* Reject API key self-deletion ([482f920](https://github.com/kernel/kernel-python-sdk/commit/482f9209f956e5615bdbaa6ec9c58081df56587b))
+* Revert "Store and return a sha256 checksum for uploaded extensions (#… ([74dbc54](https://github.com/kernel/kernel-python-sdk/commit/74dbc54d4d8d5b330f74985227fa09f7569457a7))
+* Store and return a sha256 checksum for uploaded extensions ([b266775](https://github.com/kernel/kernel-python-sdk/commit/b266775497fec10224e965c787c146494eecdae8))
+* Store and return a sha256 checksum for uploaded extensions (reland) ([98cfb28](https://github.com/kernel/kernel-python-sdk/commit/98cfb2835be3d321799bbfd0400e1bb59b39b218))
+
+
+### Documentation
+
+* **api:** clarify reuse/discard_all_idle pool config staleness ([e8641eb](https://github.com/kernel/kernel-python-sdk/commit/e8641ebe96926b22f8874a8ff79498a4cbe7e4ed))
+
 ## 0.74.0 (2026-07-06)
 
 Full Changelog: [v0.73.0...v0.74.0](https://github.com/kernel/kernel-python-sdk/compare/v0.73.0...v0.74.0)
diff --git a/pyproject.toml b/pyproject.toml
index 7d03baca..1c215e5a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.74.0"
+version = "0.75.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"
diff --git a/src/kernel/_version.py b/src/kernel/_version.py
index baf9e642..98f14c72 100644
--- a/src/kernel/_version.py
+++ b/src/kernel/_version.py
@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.74.0"  # x-release-please-version
+__version__ = "0.75.0"  # x-release-please-version