[kernel-internal]

Summary

• Update the Go SDK to v0.148.0.

Coverage

CLI coverage update for Kernel Go SDK v0.148.0

Coverage review

• Updated github.com/kernel/kernel-go-sdk from v0.145.0 to v0.148.0.
• Enumerated all 179 SDK methods from api.md, their parameter structs, and nested parameter fields.
• Enumerated the complete Cobra command tree and command flags in the CLI.
• Six SDK methods are intentionally excluded because their OpenAPI operations have x-cli-skip: true: ConfigRegistry.List, ConfigRegistry.Lookup, ConfigRegistry.Resolve, ConfigRegistry.Analyses.Get, ConfigRegistry.Analyses.List, and ConfigRegistry.Analyses.Cancel.
• After this update, all 173 non-skipped SDK methods have CLI coverage. The remaining command gap was client.Browsers.LiveView.New.

Changes

Scoped browser live views

Added kernel browsers live-view create <id-or-name> for client.Browsers.LiveView.New.

New flags:

• --scope read|control selects read-only or interactive access and defaults to read.
• --ttl-seconds sets a 1–31,536,000 second lifetime. Omitting it keeps the URL valid until browser deletion or pooled-browser release.
• --output json returns the raw SDK response.

The command validates scope and TTL locally, renders URL/scope/expiration in table output, and warns in help that the URL is a credential, is limited to the live viewer, and cannot be revoked early.

Replay startup and response coverage

The update branch already contained the v0.146/v0.147 replay coverage, retained in this diff:

• Added --start-replay to kernel browsers create, including the pool-acquisition path.
• Added --start-replay to kernel browser-pools create, update, and acquire, preserving explicit false values on update/acquire.
• Display replay IDs and available replay metadata after browser creation, browser-pool acquisition, browser get/update, and in browser and invocation-browser lists.
• Display the pool's default replay setting in kernel browser-pools get.

Managed-auth browser locale

The update branch also contains managed-auth locale coverage:

• kernel auth connections create --locale sets the canonical BCP 47 locale used by login, reauthentication, and health-check browser sessions.
• kernel auth connections update --locale replaces the locale.
• kernel auth connections update --clear-locale clears the override and returns future sessions to the browser region default.
• Connection output displays the effective configured browser locale.
• No locale flag was added to kernel auth connections login, because the SDK/spec explicitly does not support a per-login locale override.

1Password vault guidance

Updated kernel vaults items invoke, credential creation, and connection help to match the revised 1Password schemas:

• Documented the status-check cadence, fresh-status behavior, first-check wait of up to 20 seconds, timeout_seconds meaning, and 429 Retry-After handling.
• Documented the three-minute approval window and when a newly advertised 1pw_create_access_request may be used.
• Documented expired returning the item to pending_authorization and unknown being treated as failed.
• Documented the optional URL-encoded return_url supported by 1Password 8.12.46 and later.

The new response-only access_request_reference remains excluded from the CLI's display-safe vault projection because the API description says to keep it out of logs. The approval URL remains available. Tests now cover this exclusion.

Help text synchronized with the API spec

API spec operation or field	CLI help/output change
createBrowserLiveView	Added the browsers live-view create Short/Long help, including headful-only behavior, viewer-only URL scope, lifetime, pooled release, non-revocability, and credential handling.
BrowserLiveViewRequest.scope	Added --scope usage for read and control, with the read default.
BrowserLiveViewRequest.ttl_seconds	Added --ttl-seconds usage and 1–31,536,000 validation.
Browser create start_replay	Added browsers create --start-replay and replay response rendering.
Browser-pool create/update/acquire start_replay	Added the three pool --start-replay flags with create, replacement, and per-lease semantics.
ManagedAuthBrowserConfig.location.locale	Added create/update/clear locale flags and output using canonical BCP 47 terminology and region-default behavior.
OnePasswordPollAccessVaultItemOperationRequest and timeout_seconds	Updated vault operation and credential-flow help with polling cadence, timeout behavior, rate limiting, and the three-minute approval window.
OnePasswordAccessApprovalAction.url	Documented the optional return_url behavior.
1Password access-request state and credential available_operations	Documented expired, unknown, and re-advertising a new access-request operation after the status-check window.

Intentional exclusions

• The six Config Registry SDK methods listed above remain omitted because their OpenAPI operations are marked x-cli-skip: true.
• No operations or fields present only in the ahead-of-release API specification were added; the v0.148.0 SDK remains the availability boundary.
• Managed-auth locale is not exposed on auth connections login because that request type does not contain the field.
• The response-only 1Password access_request_reference is omitted from display-safe CLI output as noted above.

Validation

• go mod tidy
• go build ./...
• go test ./... -count=1
• Real-API smoke test:
  • Created a temporary headful browser.
  • Ran kernel browsers live-view create <browser> --scope control --ttl-seconds 120 --output json.
  • Verified that the response contained scope: control, a non-empty URL, and an expiration timestamp.
  • Deleted the temporary browser and verified cleanup.

The replay and managed-auth locale changes already present on the update branch were covered by their unit and command-wiring tests; they were not re-smoke-tested against live resources in this run.

Validation

• Go build
• Go vet
• Go tests

---

Note

Medium Risk
Touches auth connection browser config, pool/browser session creation, and new credential-like live-view URLs; behavior is mostly additive but misconfigured flags could change session locale or replay defaults.

Overview
Bumps kernel-go-sdk to v0.148.0 and wires new API surface into the CLI.

Scoped live views: Adds kernel browsers live-view create with --scope (read/control), optional --ttl-seconds, validation, and table/JSON output; help stresses viewer-only URLs and credential handling.

Replay: Adds --start-replay on browser create (including pool lease) and on browser-pool create/update/acquire; surfaces replay metadata in create/acquire/get/update output and optional Replay ID columns in browser and invocation browser lists.

Managed auth locale: Adds --locale on auth connection create/update and --clear-locale on update (with mutual exclusion and empty-value checks); connection detail tables show Browser Locale instead of duplicating region.

Docs/tests: Expands 1Password vault/credential invoke help (polling cadence, timeouts, return_url, expiration); keeps access_request_reference out of display-safe output. Unit tests cover locale flags, replay params, and live-view create.

^{Reviewed by Cursor Bugbot for commit d9554ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.145.0 ⏵ v0.148.0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d9554ae. Configure here.}

[cursor]

Vaults help says Kernel not KERNEL

Low Severity

New 1Password 1pw_access_request_status help in vaults_commands.go and vaults_credentials.go writes Kernel checks immediately. Vaults user-facing copy uses KERNEL for the product name (KERNEL stores it, KERNEL stores them encrypted); Kernel is the form that rule flags.

Additional Locations (1)

• cmd/vaults_credentials.go#L60-L62

 

^{Triggered by learned rule: Vaults user-facing copy is lowercase; KERNEL for product}

^{Reviewed by Cursor Bugbot for commit d9554ae. Configure here.}