CLI: Update SDK to 12b3ec6 and add new commands/flags

[kernel-internal]

This PR updates the Go SDK to 12b3ec62f63ee66d3cd8d83d9c2b9584696dd15f and adds CLI commands/flags for new SDK methods.

SDK Update

• Updated kernel-go-sdk to 12b3ec62f63ee66d3cd8d83d9c2b9584696dd15f (v0.83.1-0.20260724213320-12b3ec62f63e), from v0.79.0

Coverage Analysis

This PR was generated by performing a full enumeration of SDK methods and CLI commands.

/tmp/sdk-diff.patch was empty for this run, so the v0.79.0..12b3ec6 diff was regenerated directly from the SDK repo. api.md gained no new methods in that range — the changes are new request params plus one changed signature. A full enumeration of every api.md method against the CLI then surfaced four resources that had never been wired up; those are covered here too. /auth/connections/{id}/exchange remains excluded (x-cli-skip: true).

Important

This branch did not compile before this PR, independent of the SDK bump. The earlier Merge main into cli-coverage-update commit (8aca3c1) dropped several branch-side lines while keeping the code that called them. go build failed on main-merged HEAD with the old SDK too. Those repairs are included below and are worth a careful look, since they restore behavior that silently disappeared.

Merge Repairs

• cmd/browsers.go — restored parseStringMapFlag, which two call sites still referenced
• cmd/browser_pools.go — removed the stale 1-arg parseChromePolicy that collided with the 2-arg version in browsers.go (all call sites already pass 2 args)
• cmd/browsers.go — restored BrowsersUpdateInput.DisableDefaultProxy and included it in hasProxyChange, so browsers update --disable-default-proxy works again instead of failing the "must specify at least one of" guard
• cmd/proxies — registered the missing --url flag on proxies check and forwarded it into ProxyCheckParams (it was read from the flag set and threaded through the input struct, but never registered or sent)
• cmd/root.go — removed the duplicate rootCmd.AddCommand(projectsCmd) that listed projects twice in --help

New Flags

• --format for ProfileDownloadParams.Format on profiles download (tar.zst default, or tar to have the server decompress). Extraction skips zstd when tar is requested.
• --telemetry for ManagedAuthCreateRequestParam.BrowserTelemetry, ManagedAuthUpdateRequestParam.BrowserTelemetry, and AuthConnectionLoginParams.BrowserTelemetry on auth connections create / update / login. Reuses the existing all / off / comma-separated-category grammar from browsers and browser-pools.
• --field-value for SubmitFieldsRequestParam.FieldValues and --choice-id for SubmitFieldsRequestParam.SelectedChoiceID on auth connections submit. These are the canonical replacements for the legacy --field / --mfa-option-id / --sso-* selectors; all seven are mutually exclusive, and legacy fields is now omitted entirely when empty so the API never sees "fields": {} as a second submit mode.
• auth connections get and follow now render ManagedAuth.Fields and .Choices (with the IDs --field-value / --choice-id need), plus .BrowserSessionID and .BrowserTelemetry.

New Commands

• kernel auth connections timeline <id> for client.Auth.Connections.Timeline() — --type, --page, --per-page, using the +1 pagination trick and footer from app list / profiles list. Shows the new ManagedAuthTimelineEvent.BrowserSessionID.
• kernel profiles update <id-or-name> --name for client.Profiles.Update()
• kernel projects update <id-or-name> [--name] [--status] for client.Projects.Update()
• kernel org limits get / kernel org limits set for client.Organization.Limits.Get() / .Update()

Testing

Smoke tested against the live API; every resource created was cleaned up and the org's limits were restored to their original state.

• profiles — create, update --name, get (rename verified), delete
• profiles download — default tar.zst and --format tar against a profile with real saved data produce identical extracted trees (diff -rq clean); --format zip rejected client-side; the 202 no data yet path still handled
• auth connections — create --telemetry console,network (round-trips in browser_telemetry), update --telemetry all and --telemetry off, login --telemetry screenshot, get (renders Browser Telemetry + Browser Session ID rows)
• auth connections timeline — real login event with browser_session_id, --type login filter, --type bogus rejected, empty-timeline and past-the-end pages
• auth connections submit — --choice-id and --field-value payloads accepted by the API's request parser (rejected only on flow state, no_active_flow, not schema); mutual exclusion and KEY=value parsing verified
• projects update — --name by ID, --status archived by name (name→ID resolution), plus both validation errors
• org limits — get, set 50, verified via get, restored to no default with set 0; missing-flag and negative-value errors
• Merge-repair regressions — proxies check --url https://example.com, browsers update --disable-default-proxy on both a stealth browser (succeeds) and a non-stealth one (API rejects with a meaningful error rather than the CLI's own guard), single projects entry in --help

go build ./..., go vet ./..., and go test ./... all pass. New unit tests accompany every addition, including the timeline hasMore path that the live API could not produce (the connection only ever had one timeline event).

---

Follow-up commit: remaining api.md gaps

A concurrent run of this workflow landed the SDK bump and most of the coverage above. Re-running the enumeration against the resulting command tree surfaced uncovered surface that the first pass missed, added in 9f76db7 on top of it (no force push — the earlier work is preserved).

New Commands

• kernel api-keys rotate <id> for client.APIKeys.Rotate() — --days-to-expire, --expire-in-days, and a confirmation prompt (-y to skip). The rotated key stops working once its grace period elapses, so it is not freely reversible; --expire-in-days 0 revokes it immediately.
• kernel proxies update <id> --name for client.Proxies.Update()

New Flags

• --include-deleted for APIKeyGetParams.IncludeDeleted on api-keys get
• --env for BrowserProcessExecParams.Env on browsers process exec, and --env, --allocate-tty, --cols, --rows for BrowserProcessSpawnParams.Env/.AllocateTty/.Cols/.Rows on browsers process spawn. The code that reads these was restored by the first commit, but the flags themselves were never registered, so cobra returned zero values and the plumbing was unreachable: --env could not set a variable and --allocate-tty could not request a PTY.

Bug Fix: telemetry state reported backwards

auth connections get and follow reported an enabled connection as telemetry disabled. The API preserves the create-browser config verbatim instead of resolving it, so enabling telemetry without naming categories comes back as {"enabled": true} with no category object. formatManagedAuthTelemetry only inspected the categories, so that response rendered as disabled — the opposite of the truth. It now reports enabled (default categories); telemetry that is genuinely off still omits the row entirely.

Also reworded the spawn TTY validation error to lead with a word rather than a flag: the error renderer uppercases the first letter and was printing --Cols and --rows require --allocate-tty.

Note

The same renderer mangles pre-existing messages that start with a flag (e.g. api-keys create --days-to-expire 5000 prints --Days-To-Expire must be between 1 and 3650). That is untouched here — it predates this branch and affects several commands, so it is better fixed on its own.

Follow-up commit testing

Also smoke tested against the live API; every resource created was deleted.

• proxies update — create, rename, get (verified), delete
• api-keys rotate — create a throwaway key, rotate --expire-in-days 0 (new key issued with a distinct secret), get --include-deleted, both keys deleted. The confirmation guard also verified to fail fast in a non-interactive shell instead of rotating.
• browsers process exec --env — confirmed the variable actually reached the process (echo "FOO=$FOO" → FOO=bar), which was impossible before the flag was registered
• browsers process spawn — --allocate-tty --cols 100 --rows 40 --env T=1 accepted; --cols without --allocate-tty rejected
• auth connections — update --telemetry all then get now shows enabled (default categories) where it previously showed disabled; --telemetry console,network lists the categories; --telemetry off omits the row

go build ./..., go vet ./..., and go test ./... pass. Unit tests accompany each addition, including the api-keys rotate case where --expire-in-days 0 must reach the API as an explicit 0 rather than being dropped as a zero value.

Triggered by: kernel/kernel-go-sdk@12b3ec6
Reviewer: @rgarcia

---

Note

Medium Risk
Touches API key rotation, org concurrency defaults, and managed auth submit/telemetry—important operational paths—but changes are mostly additive CLI wiring with validation and tests.

Overview
Bumps kernel-go-sdk to v0.83.1-0.20260724213320-12b3ec62f63e and exposes previously missing SDK capabilities through new commands, flags, and README coverage.

New commands: api-keys rotate, proxies update, auth connections timeline, profiles update, projects update, and org limits get / set.

New / extended flags: API key get (--include-deleted) and rotate options; proxy check (--url); browser update (--disable-default-proxy); process exec/spawn (--env, plus PTY --allocate-tty / --cols / --rows on spawn); profile download --format; auth connection --telemetry on create/update/login and canonical submit via --field-value / --choice-id.

Behavior fixes: Restores merge-dropped wiring (parseStringMapFlag, DisableDefaultProxy on browser update, registered process flags); auth connection telemetry display no longer treats {"enabled": true} without categories as disabled; submit omits empty legacy fields so the API sees a single mode; duplicate projects root registration removed.

^{Reviewed by Cursor Bugbot for commit db12c8a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.79.0 ⏵ v0.83.1-0.20260724213320-12b3ec62f63e	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9f76db7. Configure here.}