kernel 0.100.0__tar.gz → 0.101.0__tar.gz

kernel-0.101.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.101.0"
+}

{kernel-0.100.0 → kernel-0.101.0}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.101.0](https://github.com/kernel/kernel-python-sdk/compare/v0.100.0...v0.101.0) (2026-09-11)
+
+
+### Features
+
+* Add config analysis lifecycle guarantees ([e0d9d71](https://github.com/kernel/kernel-python-sdk/commit/e0d9d715689585224cde848845ebaed90c404f64))
+* Brand origin TLS timeouts and classify provider failures ([b00a694](https://github.com/kernel/kernel-python-sdk/commit/b00a6942ff9c831f624e87c12923ee109f2d6cf7))
+* Clarify proxy country defaults ([bb00cda](https://github.com/kernel/kernel-python-sdk/commit/bb00cdaabdeb569ed1bf46b538d15de8768b9686))
+* Expose vault access in organization entitlements ([1c3b388](https://github.com/kernel/kernel-python-sdk/commit/1c3b388f1a4597f65ed3926a8ec2646f5e0fc994))
+* Integrate configurable vault providers across API and checkout ([478bc09](https://github.com/kernel/kernel-python-sdk/commit/478bc09cc5c8f6b2850628d02b88d699cc35328f))
+* Limit free organizations to three vaults ([b0d5628](https://github.com/kernel/kernel-python-sdk/commit/b0d5628acbe0a9d9d006a3349ba1338fdc3d4402))
+* Populate safe failure reasons on invocation responses ([7162cbb](https://github.com/kernel/kernel-python-sdk/commit/7162cbbed49eb4d0a8d431bbb84680e48bdce8a2))
+* Return vendor guidance with config registry recommendations ([938e40b](https://github.com/kernel/kernel-python-sdk/commit/938e40b2a9f4e37ef8221787debbb948e019eeeb))
+* Revert vendor guidance recommendations ([adacc13](https://github.com/kernel/kernel-python-sdk/commit/adacc1321a9c1cc1624e5adf6c2521b0f09851f4))
+* Support international ISP proxy countries ([78adb8a](https://github.com/kernel/kernel-python-sdk/commit/78adb8a4ae929028497e30b0a5988050eee7c1f4))
+
 ## [0.100.0](https://github.com/kernel/kernel-python-sdk/compare/v0.99.0...v0.100.0) (2026-09-04)
 
 

{kernel-0.100.0 → kernel-0.101.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.100.0
+Version: 0.101.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.100.0 → kernel-0.101.0}/api.md

@@ -487,6 +487,22 @@ Methods:
 - <code title="post /browser_pools/{id_or_name}/flush">client.browser_pools.<a href="./src/kernel/resources/browser_pools.py">flush</a>(id_or_name) -> None</code>
 - <code title="post /browser_pools/{id_or_name}/release">client.browser_pools.<a href="./src/kernel/resources/browser_pools.py">release</a>(id_or_name, \*\*<a href="src/kernel/types/browser_pool_release_params.py">params</a>) -> None</code>
 
+# VaultProviderConfigs
+
+Types:
+
+```python
+from kernel.types import VaultProviderConfig
+```
+
+Methods:
+
+- <code title="post /vault-provider-configs">client.vault_provider_configs.<a href="./src/kernel/resources/vault_provider_configs.py">create</a>(\*\*<a href="src/kernel/types/vault_provider_config_create_params.py">params</a>) -> <a href="./src/kernel/types/vault_provider_config.py">VaultProviderConfig</a></code>
+- <code title="get /vault-provider-configs/{id_or_name}">client.vault_provider_configs.<a href="./src/kernel/resources/vault_provider_configs.py">retrieve</a>(id_or_name) -> <a href="./src/kernel/types/vault_provider_config.py">VaultProviderConfig</a></code>
+- <code title="patch /vault-provider-configs/{id_or_name}">client.vault_provider_configs.<a href="./src/kernel/resources/vault_provider_configs.py">update</a>(id_or_name, \*\*<a href="src/kernel/types/vault_provider_config_update_params.py">params</a>) -> <a href="./src/kernel/types/vault_provider_config.py">VaultProviderConfig</a></code>
+- <code title="get /vault-provider-configs">client.vault_provider_configs.<a href="./src/kernel/resources/vault_provider_configs.py">list</a>(\*\*<a href="src/kernel/types/vault_provider_config_list_params.py">params</a>) -> <a href="./src/kernel/types/vault_provider_config.py">SyncOffsetPagination[VaultProviderConfig]</a></code>
+- <code title="delete /vault-provider-configs/{id_or_name}">client.vault_provider_configs.<a href="./src/kernel/resources/vault_provider_configs.py">delete</a>(id_or_name) -> None</code>
+
 # Vaults
 
 Types:

{kernel-0.100.0 → kernel-0.101.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.100.0"
+version = "0.101.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.100.0 → kernel-0.101.0}/src/kernel/_base_client.py

@@ -772,6 +772,9 @@ class BaseClient(Generic[_HttpxClientT, _DefaultStreamT]):
         timeout = sleep_seconds * jitter
         return timeout if timeout >= 0 else 0
 
+    def _should_retry_on_connection_error(self, _request: httpx.Request) -> bool:
+        return True
+
     def _should_retry(self, response: httpx.Response) -> bool:
         # Note: this is not a standard header
         should_retry_header = response.headers.get("x-should-retry")
@@ -1012,7 +1015,7 @@ class SyncAPIClient(BaseClient[httpx.Client, Stream[Any]]):
             except httpx.TimeoutException as err:
                 log.debug("Encountered httpx.TimeoutException", exc_info=True)
 
-                if remaining_retries > 0:
+                if remaining_retries > 0 and self._should_retry_on_connection_error(request):
                     self._sleep_for_retry(
                         retries_taken=retries_taken,
                         max_retries=max_retries,
@@ -1026,7 +1029,7 @@ class SyncAPIClient(BaseClient[httpx.Client, Stream[Any]]):
             except Exception as err:
                 log.debug("Encountered Exception", exc_info=True)
 
-                if remaining_retries > 0:
+                if remaining_retries > 0 and self._should_retry_on_connection_error(request):
                     self._sleep_for_retry(
                         retries_taken=retries_taken,
                         max_retries=max_retries,
@@ -1596,7 +1599,7 @@ class AsyncAPIClient(BaseClient[httpx.AsyncClient, AsyncStream[Any]]):
             except httpx.TimeoutException as err:
                 log.debug("Encountered httpx.TimeoutException", exc_info=True)
 
-                if remaining_retries > 0:
+                if remaining_retries > 0 and self._should_retry_on_connection_error(request):
                     await self._sleep_for_retry(
                         retries_taken=retries_taken,
                         max_retries=max_retries,
@@ -1610,7 +1613,7 @@ class AsyncAPIClient(BaseClient[httpx.AsyncClient, AsyncStream[Any]]):
             except Exception as err:
                 log.debug("Encountered Exception", exc_info=True)
 
-                if remaining_retries > 0:
+                if remaining_retries > 0 and self._should_retry_on_connection_error(request):
                     await self._sleep_for_retry(
                         retries_taken=retries_taken,
                         max_retries=max_retries,

{kernel-0.100.0 → kernel-0.101.0}/src/kernel/_client.py

@@ -38,11 +38,18 @@ from ._base_client import (
 from .lib.browser_routing.routing import (
     BrowserRouteCache,
     BrowserRoutingConfig,
-    strip_direct_vm_auth,
+    prepare_direct_vm_request,
     rewrite_direct_vm_options,
     browser_routing_config_from_env,
+    install_direct_vm_auth_stripping,
+    is_stale_direct_vm_auth_response,
     should_retry_stale_direct_vm_auth,
+    install_stale_direct_vm_auth_eviction,
+    install_async_direct_vm_auth_stripping,
     maybe_evict_browser_route_from_response,
+    should_retry_direct_vm_connection_error,
+    install_async_stale_direct_vm_auth_eviction,
+    direct_vm_request_body_is_known_unreplayable,
     maybe_populate_browser_route_cache_from_response,
 )
 
@@ -66,6 +73,7 @@ if TYPE_CHECKING:
         browser_pools,
         config_registry,
         credential_providers,
+        vault_provider_configs,
     )
     from .resources.apps import AppsResource, AsyncAppsResource
     from .resources.proxies import ProxiesResource, AsyncProxiesResource
@@ -83,6 +91,7 @@ if TYPE_CHECKING:
     from .resources.telemetry.telemetry import TelemetryResource, AsyncTelemetryResource
     from .resources.credential_providers import CredentialProvidersResource, AsyncCredentialProvidersResource
     from .resources.audit_logs.audit_logs import AuditLogsResource, AsyncAuditLogsResource
+    from .resources.vault_provider_configs import VaultProviderConfigsResource, AsyncVaultProviderConfigsResource
     from .resources.organization.organization import OrganizationResource, AsyncOrganizationResource
     from .resources.config_registry.config_registry import ConfigRegistryResource, AsyncConfigRegistryResource
 
@@ -205,6 +214,8 @@ class Kernel(SyncAPIClient):
         )
         self.browser_route_cache = _browser_route_cache or BrowserRouteCache()
         self._browser_routing = browser_routing_config_from_env()
+        install_direct_vm_auth_stripping(self._client)
+        install_stale_direct_vm_auth_eviction(self._client)
 
     @cached_property
     def deployments(self) -> DeploymentsResource:
@@ -281,6 +292,12 @@ class Kernel(SyncAPIClient):
 
         return BrowserPoolsResource(self)
 
+    @cached_property
+    def vault_provider_configs(self) -> VaultProviderConfigsResource:
+        from .resources.vault_provider_configs import VaultProviderConfigsResource
+
+        return VaultProviderConfigsResource(self)
+
     @cached_property
     def vaults(self) -> VaultsResource:
         from .resources.vaults import VaultsResource
@@ -369,13 +386,21 @@ class Kernel(SyncAPIClient):
 
     @override
     def _prepare_request(self, request: httpx.Request) -> None:
-        strip_direct_vm_auth(request, cache=self.browser_route_cache)
+        prepare_direct_vm_request(request, cache=self.browser_route_cache)
+
+    @override
+    def _should_retry_on_connection_error(self, request: httpx.Request) -> bool:
+        return should_retry_direct_vm_connection_error(request)
 
     @override
     def _should_retry(self, response: httpx.Response) -> bool:
-        if should_retry_stale_direct_vm_auth(response):
-            maybe_evict_browser_route_from_response(response, cache=self.browser_route_cache)
-            return True
+        if direct_vm_request_body_is_known_unreplayable(response.request):
+            return False
+        if is_stale_direct_vm_auth_response(response):
+            # The route was already evicted by the response hook; retry only when
+            # the body can be rebuilt, otherwise the caller sees the original auth
+            # failure and a later call goes to the control plane.
+            return should_retry_stale_direct_vm_auth(response)
         return super()._should_retry(response)
 
     @override
@@ -594,6 +619,8 @@ class AsyncKernel(AsyncAPIClient):
         )
         self.browser_route_cache = _browser_route_cache or BrowserRouteCache()
         self._browser_routing = browser_routing_config_from_env()
+        install_async_direct_vm_auth_stripping(self._client)
+        install_async_stale_direct_vm_auth_eviction(self._client)
 
     @cached_property
     def deployments(self) -> AsyncDeploymentsResource:
@@ -670,6 +697,12 @@ class AsyncKernel(AsyncAPIClient):
 
         return AsyncBrowserPoolsResource(self)
 
+    @cached_property
+    def vault_provider_configs(self) -> AsyncVaultProviderConfigsResource:
+        from .resources.vault_provider_configs import AsyncVaultProviderConfigsResource
+
+        return AsyncVaultProviderConfigsResource(self)
+
     @cached_property
     def vaults(self) -> AsyncVaultsResource:
         from .resources.vaults import AsyncVaultsResource
@@ -758,13 +791,21 @@ class AsyncKernel(AsyncAPIClient):
 
     @override
     async def _prepare_request(self, request: httpx.Request) -> None:
-        strip_direct_vm_auth(request, cache=self.browser_route_cache)
+        prepare_direct_vm_request(request, cache=self.browser_route_cache)
+
+    @override
+    def _should_retry_on_connection_error(self, request: httpx.Request) -> bool:
+        return should_retry_direct_vm_connection_error(request)
 
     @override
     def _should_retry(self, response: httpx.Response) -> bool:
-        if should_retry_stale_direct_vm_auth(response):
-            maybe_evict_browser_route_from_response(response, cache=self.browser_route_cache)
-            return True
+        if direct_vm_request_body_is_known_unreplayable(response.request):
+            return False
+        if is_stale_direct_vm_auth_response(response):
+            # The route was already evicted by the response hook; retry only when
+            # the body can be rebuilt, otherwise the caller sees the original auth
+            # failure and a later call goes to the control plane.
+            return should_retry_stale_direct_vm_auth(response)
         return super()._should_retry(response)
 
     @override
@@ -963,6 +1004,12 @@ class KernelWithRawResponse:
 
         return BrowserPoolsResourceWithRawResponse(self._client.browser_pools)
 
+    @cached_property
+    def vault_provider_configs(self) -> vault_provider_configs.VaultProviderConfigsResourceWithRawResponse:
+        from .resources.vault_provider_configs import VaultProviderConfigsResourceWithRawResponse
+
+        return VaultProviderConfigsResourceWithRawResponse(self._client.vault_provider_configs)
+
     @cached_property
     def vaults(self) -> vaults.VaultsResourceWithRawResponse:
         from .resources.vaults import VaultsResourceWithRawResponse
@@ -1096,6 +1143,12 @@ class AsyncKernelWithRawResponse:
 
         return AsyncBrowserPoolsResourceWithRawResponse(self._client.browser_pools)
 
+    @cached_property
+    def vault_provider_configs(self) -> vault_provider_configs.AsyncVaultProviderConfigsResourceWithRawResponse:
+        from .resources.vault_provider_configs import AsyncVaultProviderConfigsResourceWithRawResponse
+
+        return AsyncVaultProviderConfigsResourceWithRawResponse(self._client.vault_provider_configs)
+
     @cached_property
     def vaults(self) -> vaults.AsyncVaultsResourceWithRawResponse:
         from .resources.vaults import AsyncVaultsResourceWithRawResponse
@@ -1229,6 +1282,12 @@ class KernelWithStreamedResponse:
 
         return BrowserPoolsResourceWithStreamingResponse(self._client.browser_pools)
 
+    @cached_property
+    def vault_provider_configs(self) -> vault_provider_configs.VaultProviderConfigsResourceWithStreamingResponse:
+        from .resources.vault_provider_configs import VaultProviderConfigsResourceWithStreamingResponse
+
+        return VaultProviderConfigsResourceWithStreamingResponse(self._client.vault_provider_configs)
+
     @cached_property
     def vaults(self) -> vaults.VaultsResourceWithStreamingResponse:
         from .resources.vaults import VaultsResourceWithStreamingResponse
@@ -1362,6 +1421,12 @@ class AsyncKernelWithStreamedResponse:
 
         return AsyncBrowserPoolsResourceWithStreamingResponse(self._client.browser_pools)
 
+    @cached_property
+    def vault_provider_configs(self) -> vault_provider_configs.AsyncVaultProviderConfigsResourceWithStreamingResponse:
+        from .resources.vault_provider_configs import AsyncVaultProviderConfigsResourceWithStreamingResponse
+
+        return AsyncVaultProviderConfigsResourceWithStreamingResponse(self._client.vault_provider_configs)
+
     @cached_property
     def vaults(self) -> vaults.AsyncVaultsResourceWithStreamingResponse:
         from .resources.vaults import AsyncVaultsResourceWithStreamingResponse

{kernel-0.100.0 → kernel-0.101.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.100.0"  # x-release-please-version
+__version__ = "0.101.0"  # x-release-please-version

{kernel-0.100.0 → kernel-0.101.0}/src/kernel/lib/browser_routing/raw_http.py

@@ -7,7 +7,7 @@ from collections.abc import Iterable, Iterator, AsyncIterator
 import httpx
 
 from .util import sanitize_curl_raw_params
-from .routing import BrowserRoute
+from .routing import BrowserRoute, mark_direct_vm_headers, direct_vm_request_extensions
 from ..._types import Body, Timeout, NotGiven, not_given
 from ..._models import FinalRequestOptions
 
@@ -33,7 +33,7 @@ def request_via_browser_route(
         method=method.upper(),
         url=route.base_url.rstrip("/") + "/curl/raw",
         params=query,
-        headers=headers or {},
+        headers=mark_direct_vm_headers(headers),
         content=_normalize_binary_content(content),
         json_data=json,
         timeout=_normalize_timeout(timeout),
@@ -70,6 +70,7 @@ def stream_via_browser_route(
         headers=request_headers,
         content=_normalize_binary_content(content),
         timeout=_normalize_timeout(effective_timeout),
+        extensions=direct_vm_request_extensions(cache=parent.browser_route_cache),
     ) as response:
         yield response
 
@@ -93,7 +94,7 @@ async def async_request_via_browser_route(
         method=method.upper(),
         url=route.base_url.rstrip("/") + "/curl/raw",
         params=query,
-        headers=headers or {},
+        headers=mark_direct_vm_headers(headers),
         content=_normalize_binary_content(content),
         json_data=json,
         timeout=_normalize_timeout(timeout),
@@ -130,6 +131,7 @@ async def async_stream_via_browser_route(
         headers=request_headers,
         content=_normalize_binary_content(content),
         timeout=_normalize_timeout(effective_timeout),
+        extensions=direct_vm_request_extensions(cache=parent.browser_route_cache),
     ) as response:
         yield response