Add custom proxy CA bundle flag - #212
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
chruffins
marked this pull request as ready for review
July 29, 2026 14:36
hiroTamada
approved these changes
Jul 29, 2026
rgarcia
added a commit
that referenced
this pull request
Jul 31, 2026
…edential flags (#210) This PR updates the Go SDK to e6dff4a41334b0008f7d0469bf83477905cdc589 and adds CLI flags for uncovered SDK request-param fields. ## SDK Update - `e6dff4a41334b0008f7d0469bf83477905cdc589` **is** the `v0.85.0` tag, which `go.mod` already pinned. `go get` + `go mod tidy` resolved to the same version, so there is no dependency change in this push. The api.md diff against the CLI's previous SDK version is empty. ## Coverage Analysis A full enumeration was performed rather than relying on the (empty) diff: - **128 SDK methods** extracted from `api.md` — all have corresponding CLI commands. The three that don't call the plain SDK method (`Browsers.Logs.Stream`, `Browsers.Telemetry.Stream`, `Browsers.Process.StdoutStream`) use the SSE `*Streaming` variants and are covered by `browsers logs stream`, `browsers telemetry stream`, and `browsers process stdout-stream`. - **286 request-param fields** extracted from all `*Params`/`*Param` structs and checked against every identifier in `cmd/` and `pkg/`. This surfaced 8 pre-existing gaps, closed below. - The one endpoint marked `x-cli-skip: true` (`POST /auth/connections/{id}/exchange`, the hosted login UI's handoff exchange) is correctly absent. ## Build Fix The merge of `main` into this branch unioned two independent implementations of the proxy CA bundle feature (this branch's, and #212 on `main`), leaving the tree **uncompilable** — `undefined: io`, and `in.CaBundle` referenced on a struct without that field. Resolved to main's shipped `--ca-bundle <path>` semantics and dropped the duplicate inline/stdin variant. Worth noting: keeping both would have silently redefined `--ca-bundle` from "path to a PEM file" to "inline PEM content" for anyone already using the flag from `main`. ## New Flags | Flag | SDK field | |---|---| | `kernel auth connections create --record-session` | `ManagedAuthCreateRequestParam.RecordSession` | | `kernel auth connections create --no-health-checks` | `ManagedAuthCreateRequestParam.HealthChecks` | | `kernel auth connections create --no-auto-reauth` | `ManagedAuthCreateRequestParam.AutoReauth` | | `kernel auth connections update --record-session[=true|false]` | `ManagedAuthUpdateRequestParam.RecordSession` | | `kernel auth connections update --health-checks` / `--no-health-checks` | `ManagedAuthUpdateRequestParam.HealthChecks` | | `kernel auth connections update --auto-reauth` / `--no-auto-reauth` | `ManagedAuthUpdateRequestParam.AutoReauth` | | `kernel auth connections login --record-session[=true|false]` | `AuthConnectionLoginParams.RecordSession` | | `kernel browsers replays start --record-audio` | `BrowserReplayStartParams.RecordAudio` | | `kernel credentials update --remove-value-key` | `UpdateCredentialRequestParam.RemoveValueKeys` | `--record-session` is a single tri-state boolean on create, update, and login: omitting it leaves the API default or existing connection setting untouched, `--record-session` sends true, and `--record-session=false` sends false. The remaining positive/negative update pairs are marked mutually exclusive. ## Deliberately Not Added `BrowserCurlParams.TimeoutMs` and `BrowserCurlParams.ResponseEncoding`. `kernel browsers curl` does not call the SDK's `Curl` method — it proxies through a raw HTTP client (`browsers.HTTPClient`) for binary-safe streaming, header dumping, and `--write-out`. `--max-time` already covers the timeout, and response encoding is meaningless when raw bytes go straight to stdout or `-o`. Adding either flag would give the user a knob wired to nothing. ## Testing Against the live API, with all resources deleted afterward: - `auth connections create --record-session --no-health-checks --no-auto-reauth` → response echoed `record_session=true`, `health_checks=false`, `auto_reauth=false` - `auth connections update` exercised in both directions, plus an unrelated-field-only update (`--health-check-interval 3600`) confirming omitted toggles are left untouched - Mutually-exclusive pairs correctly rejected - `credentials update --remove-value-key otp_backup` → key removed; `--remove-value-key password --value password=newsecret` → new value kept, confirming removals apply before the merge - `browsers replays start --record-audio` → started, stopped, and listed successfully - Request bodies captured against a local listener to verify tri-state on the wire (the API does not echo these fields back): `{"record_audio":true}` vs `{}`, and `{"record_session":true}` / `{"record_session":false}` / `{}` - `go build ./...`, `go vet ./...`, `gofmt -l cmd/`, and `go test -count=1 ./...` all pass Triggered by: kernel/kernel-go-sdk@e6dff4a Reviewer: @stainless-app <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Changes are additive CLI-to-API mappings and display tweaks; managed-auth toggles affect connection behavior only when users set them explicitly. > > **Overview** > Wires previously uncovered **Go SDK request fields** into the CLI and tightens a few command outputs. > > **Managed auth (`kernel auth connections`)** gains flags for **health checks**, **auto re-auth**, and **session recording**: create uses `--no-health-checks`, `--no-auto-reauth`, and `--record-session`; update adds paired `--health-checks` / `--no-health-checks` and `--auto-reauth` / `--no-auto-reauth` (tri-state, like save-credentials) plus `--record-session`; login can override recording per flow. **`timeline`** adds a **Telemetry** column (yes/no when the event has a browser session and the API reports `telemetry_captured`). > > **Browsers** `replays start` adds **`--record-audio`**. **Credentials** `update` adds repeatable **`--remove-value-key`** (applied before `--value` merges). Shared **`readBoolFlag`** distinguishes omitted bool flags from explicit `false`. > > **Proxies** surface **Has CA Bundle** in check/get/list/create output, warn when `--ca-bundle` is used on non-custom types, and note CA bundle on custom proxy list lines. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 174f857. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: kernel-internal[bot] <260533166+kernel-internal[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Rafael Garcia <raf@kernel.sh>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
kernel proxies createnow supports custom TLS-terminating proxies with a local CA bundle:--ca-bundle <path>reads a PEM bundle from disk and sends its contents with the create request. Missing or empty files fail before an API request.--nameis required for every proxy type, matching the API requirement. CLI help and all create examples include it.ca_bundlerequest field.Testing
make testmake build./bin/kernel proxies create --help./bin/kernel proxies create --type datacenter(verifies the missing-name error)