kernel 0.87.0__tar.gz → 0.88.0__tar.gz

kernel-0.88.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.88.0"
+}

{kernel-0.87.0 → kernel-0.88.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.88.0](https://github.com/kernel/kernel-python-sdk/compare/v0.87.0...v0.88.0) (2026-08-10)
+
+### Features
+
+* Add typed browser proxy configuration using `mode`, `id`, or `name`
+* Add nested managed-auth browser configuration and per-login browser overrides
+
 ## 0.87.0 (2026-08-08)
 
 Full Changelog: [v0.86.1...v0.87.0](https://github.com/kernel/kernel-python-sdk/compare/v0.86.1...v0.87.0)

{kernel-0.87.0 → kernel-0.88.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.87.0
+Version: 0.88.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.87.0 → kernel-0.88.0}/api.md

@@ -81,6 +81,9 @@ Types:
 ```python
 from kernel.types import (
     BrowserPoolRef,
+    BrowserProxy,
+    BrowserProxyConfig,
+    BrowserProxyMode,
     BrowserUsage,
     Profile,
     Tags,
@@ -314,6 +317,7 @@ Types:
 from kernel.types.auth import (
     LoginResponse,
     ManagedAuth,
+    ManagedAuthBrowserConfig,
     ManagedAuthCreateRequest,
     ManagedAuthTimelineEvent,
     ManagedAuthUpdateRequest,

{kernel-0.87.0 → kernel-0.88.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.87.0"
+version = "0.88.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.87.0 → kernel-0.88.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.87.0"  # x-release-please-version
+__version__ = "0.88.0"  # x-release-please-version

{kernel-0.87.0 → kernel-0.88.0}/src/kernel/resources/auth/connections.py

@@ -33,6 +33,7 @@ from ...types.auth.login_response import LoginResponse
 from ...types.auth.submit_fields_response import SubmitFieldsResponse
 from ...types.auth.connection_follow_response import ConnectionFollowResponse
 from ...types.auth.managed_auth_timeline_event import ManagedAuthTimelineEvent
+from ...types.auth.managed_auth_browser_config_param import ManagedAuthBrowserConfigParam
 
 __all__ = ["ConnectionsResource", "AsyncConnectionsResource"]
 
@@ -66,6 +67,7 @@ class ConnectionsResource(SyncAPIResource):
         profile_name: str,
         allowed_domains: SequenceNotStr[str] | Omit = omit,
         auto_reauth: bool | Omit = omit,
+        browser: ManagedAuthBrowserConfigParam | Omit = omit,
         browser_telemetry: Optional[connection_create_params.BrowserTelemetry] | Omit = omit,
         credential: connection_create_params.Credential | Omit = omit,
         health_check_interval: int | Omit = omit,
@@ -120,9 +122,11 @@ class ConnectionsResource(SyncAPIResource):
               false, expired sessions are marked as `NEEDS_AUTH` instead of attempting
               re-auth. Defaults to true.
 
-          browser_telemetry: Browser telemetry configuration used by this connection's browser sessions by
-              default. Uses the exact create-browser configuration. Can be overridden
-              per-login.
+          browser: Default browser configuration for login, reauthentication, and health-check
+              sessions.
+
+          browser_telemetry: Deprecated. Use browser.telemetry. Retained during migration for existing
+              clients.
 
           credential:
               Reference to credentials for the auth connection. Use one of:
@@ -133,9 +137,10 @@ class ConnectionsResource(SyncAPIResource):
 
           health_check_interval: Interval in seconds between automatic health checks. When set, the system
               periodically verifies the authentication status and triggers re-authentication
-              if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour). The minimum
-              depends on your plan: Enterprise: 300 (5 minutes), Startup: 1200 (20 minutes),
-              Hobbyist: 3600 (1 hour).
+              if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour) or your plan
+              minimum, whichever is larger. The minimum depends on your plan: Enterprise: 300
+              (5 minutes), Startup: 1200 (20 minutes), Hobbyist: 3600 (1 hour), Free: 21600 (6
+              hours).
 
           health_checks: Whether to enable periodic health checks. When false, the system will not
               automatically verify authentication status, and `auto_reauth` has no effect on
@@ -144,10 +149,7 @@ class ConnectionsResource(SyncAPIResource):
 
           login_url: Optional login page URL to skip discovery
 
-          proxy: Proxy selection. Provide either id or name. The proxy must be in the same
-              project as the resource referencing it. When selecting by name, the name must
-              match exactly one active proxy in the project. Ambiguous names return a 400; use
-              id for stable references.
+          proxy: Deprecated. Use browser.proxy. Retained during migration for existing clients.
 
           record_session: Whether to record browser sessions for this connection by default. Useful for
               debugging. Can be overridden per-login. Defaults to false.
@@ -171,6 +173,7 @@ class ConnectionsResource(SyncAPIResource):
                     "profile_name": profile_name,
                     "allowed_domains": allowed_domains,
                     "auto_reauth": auto_reauth,
+                    "browser": browser,
                     "browser_telemetry": browser_telemetry,
                     "credential": credential,
                     "health_check_interval": health_check_interval,
@@ -229,6 +232,7 @@ class ConnectionsResource(SyncAPIResource):
         *,
         allowed_domains: SequenceNotStr[str] | Omit = omit,
         auto_reauth: bool | Omit = omit,
+        browser: ManagedAuthBrowserConfigParam | Omit = omit,
         browser_telemetry: Optional[connection_update_params.BrowserTelemetry] | Omit = omit,
         credential: connection_update_params.Credential | Omit = omit,
         health_check_interval: int | Omit = omit,
@@ -260,9 +264,11 @@ class ConnectionsResource(SyncAPIResource):
               when `health_checks` is false. When false, expired sessions detected by a health
               check are marked as `NEEDS_AUTH` instead of attempting re-auth.
 
-          browser_telemetry: Browser telemetry configuration used by future browser sessions for this
-              connection. Uses the exact create-browser configuration. Set enabled to false to
-              disable telemetry.
+          browser: Browser configuration updates for future login, reauthentication, and
+              health-check sessions. Omitted properties remain unchanged.
+
+          browser_telemetry: Deprecated. Use browser.telemetry. Retained during migration for existing
+              clients.
 
           credential:
               Reference to credentials for the auth connection. Use one of:
@@ -280,10 +286,7 @@ class ConnectionsResource(SyncAPIResource):
 
           login_url: Login page URL. Set to empty string to clear.
 
-          proxy: Proxy selection. Provide either id or name. The proxy must be in the same
-              project as the resource referencing it. When selecting by name, the name must
-              match exactly one active proxy in the project. Ambiguous names return a 400; use
-              id for stable references.
+          proxy: Deprecated. Use browser.proxy. Retained during migration for existing clients.
 
           record_session: Whether to record browser sessions for this connection by default
 
@@ -305,6 +308,7 @@ class ConnectionsResource(SyncAPIResource):
                 {
                     "allowed_domains": allowed_domains,
                     "auto_reauth": auto_reauth,
+                    "browser": browser,
                     "browser_telemetry": browser_telemetry,
                     "credential": credential,
                     "health_check_interval": health_check_interval,
@@ -464,6 +468,7 @@ class ConnectionsResource(SyncAPIResource):
         self,
         id: str,
         *,
+        browser: ManagedAuthBrowserConfigParam | Omit = omit,
         browser_telemetry: Optional[connection_login_params.BrowserTelemetry] | Omit = omit,
         proxy: connection_login_params.Proxy | Omit = omit,
         record_session: bool | Omit = omit,
@@ -481,14 +486,13 @@ class ConnectionsResource(SyncAPIResource):
         credentials are stored.
 
         Args:
-          browser_telemetry: Override the connection's default browser telemetry configuration for this
-              login. When omitted, the connection's browser_telemetry default is used. Uses
-              the exact create-browser configuration.
+          browser: Browser configuration override for this login. Omitted properties inherit the
+              connection defaults.
+
+          browser_telemetry: Deprecated. Use browser.telemetry. Retained during migration for existing
+              clients.
 
-          proxy: Proxy selection. Provide either id or name. The proxy must be in the same
-              project as the resource referencing it. When selecting by name, the name must
-              match exactly one active proxy in the project. Ambiguous names return a 400; use
-              id for stable references.
+          proxy: Deprecated. Use browser.proxy. Retained during migration for existing clients.
 
           record_session: Override the connection's default for recording this login's browser session.
               When omitted, the connection's record_session default is used.
@@ -507,6 +511,7 @@ class ConnectionsResource(SyncAPIResource):
             path_template("/auth/connections/{id}/login", id=id),
             body=maybe_transform(
                 {
+                    "browser": browser,
                     "browser_telemetry": browser_telemetry,
                     "proxy": proxy,
                     "record_session": record_session,
@@ -675,6 +680,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
         profile_name: str,
         allowed_domains: SequenceNotStr[str] | Omit = omit,
         auto_reauth: bool | Omit = omit,
+        browser: ManagedAuthBrowserConfigParam | Omit = omit,
         browser_telemetry: Optional[connection_create_params.BrowserTelemetry] | Omit = omit,
         credential: connection_create_params.Credential | Omit = omit,
         health_check_interval: int | Omit = omit,
@@ -729,9 +735,11 @@ class AsyncConnectionsResource(AsyncAPIResource):
               false, expired sessions are marked as `NEEDS_AUTH` instead of attempting
               re-auth. Defaults to true.
 
-          browser_telemetry: Browser telemetry configuration used by this connection's browser sessions by
-              default. Uses the exact create-browser configuration. Can be overridden
-              per-login.
+          browser: Default browser configuration for login, reauthentication, and health-check
+              sessions.
+
+          browser_telemetry: Deprecated. Use browser.telemetry. Retained during migration for existing
+              clients.
 
           credential:
               Reference to credentials for the auth connection. Use one of:
@@ -742,9 +750,10 @@ class AsyncConnectionsResource(AsyncAPIResource):
 
           health_check_interval: Interval in seconds between automatic health checks. When set, the system
               periodically verifies the authentication status and triggers re-authentication
-              if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour). The minimum
-              depends on your plan: Enterprise: 300 (5 minutes), Startup: 1200 (20 minutes),
-              Hobbyist: 3600 (1 hour).
+              if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour) or your plan
+              minimum, whichever is larger. The minimum depends on your plan: Enterprise: 300
+              (5 minutes), Startup: 1200 (20 minutes), Hobbyist: 3600 (1 hour), Free: 21600 (6
+              hours).
 
           health_checks: Whether to enable periodic health checks. When false, the system will not
               automatically verify authentication status, and `auto_reauth` has no effect on
@@ -753,10 +762,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
 
           login_url: Optional login page URL to skip discovery
 
-          proxy: Proxy selection. Provide either id or name. The proxy must be in the same
-              project as the resource referencing it. When selecting by name, the name must
-              match exactly one active proxy in the project. Ambiguous names return a 400; use
-              id for stable references.
+          proxy: Deprecated. Use browser.proxy. Retained during migration for existing clients.
 
           record_session: Whether to record browser sessions for this connection by default. Useful for
               debugging. Can be overridden per-login. Defaults to false.
@@ -780,6 +786,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
                     "profile_name": profile_name,
                     "allowed_domains": allowed_domains,
                     "auto_reauth": auto_reauth,
+                    "browser": browser,
                     "browser_telemetry": browser_telemetry,
                     "credential": credential,
                     "health_check_interval": health_check_interval,
@@ -838,6 +845,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
         *,
         allowed_domains: SequenceNotStr[str] | Omit = omit,
         auto_reauth: bool | Omit = omit,
+        browser: ManagedAuthBrowserConfigParam | Omit = omit,
         browser_telemetry: Optional[connection_update_params.BrowserTelemetry] | Omit = omit,
         credential: connection_update_params.Credential | Omit = omit,
         health_check_interval: int | Omit = omit,
@@ -869,9 +877,11 @@ class AsyncConnectionsResource(AsyncAPIResource):
               when `health_checks` is false. When false, expired sessions detected by a health
               check are marked as `NEEDS_AUTH` instead of attempting re-auth.
 
-          browser_telemetry: Browser telemetry configuration used by future browser sessions for this
-              connection. Uses the exact create-browser configuration. Set enabled to false to
-              disable telemetry.
+          browser: Browser configuration updates for future login, reauthentication, and
+              health-check sessions. Omitted properties remain unchanged.
+
+          browser_telemetry: Deprecated. Use browser.telemetry. Retained during migration for existing
+              clients.
 
           credential:
               Reference to credentials for the auth connection. Use one of:
@@ -889,10 +899,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
 
           login_url: Login page URL. Set to empty string to clear.
 
-          proxy: Proxy selection. Provide either id or name. The proxy must be in the same
-              project as the resource referencing it. When selecting by name, the name must
-              match exactly one active proxy in the project. Ambiguous names return a 400; use
-              id for stable references.
+          proxy: Deprecated. Use browser.proxy. Retained during migration for existing clients.
 
           record_session: Whether to record browser sessions for this connection by default
 
@@ -914,6 +921,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
                 {
                     "allowed_domains": allowed_domains,
                     "auto_reauth": auto_reauth,
+                    "browser": browser,
                     "browser_telemetry": browser_telemetry,
                     "credential": credential,
                     "health_check_interval": health_check_interval,
@@ -1073,6 +1081,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
         self,
         id: str,
         *,
+        browser: ManagedAuthBrowserConfigParam | Omit = omit,
         browser_telemetry: Optional[connection_login_params.BrowserTelemetry] | Omit = omit,
         proxy: connection_login_params.Proxy | Omit = omit,
         record_session: bool | Omit = omit,
@@ -1090,14 +1099,13 @@ class AsyncConnectionsResource(AsyncAPIResource):
         credentials are stored.
 
         Args:
-          browser_telemetry: Override the connection's default browser telemetry configuration for this
-              login. When omitted, the connection's browser_telemetry default is used. Uses
-              the exact create-browser configuration.
+          browser: Browser configuration override for this login. Omitted properties inherit the
+              connection defaults.
+
+          browser_telemetry: Deprecated. Use browser.telemetry. Retained during migration for existing
+              clients.
 
-          proxy: Proxy selection. Provide either id or name. The proxy must be in the same
-              project as the resource referencing it. When selecting by name, the name must
-              match exactly one active proxy in the project. Ambiguous names return a 400; use
-              id for stable references.
+          proxy: Deprecated. Use browser.proxy. Retained during migration for existing clients.
 
           record_session: Override the connection's default for recording this login's browser session.
               When omitted, the connection's record_session default is used.
@@ -1116,6 +1124,7 @@ class AsyncConnectionsResource(AsyncAPIResource):
             path_template("/auth/connections/{id}/login", id=id),
             body=await async_maybe_transform(
                 {
+                    "browser": browser,
                     "browser_telemetry": browser_telemetry,
                     "proxy": proxy,
                     "record_session": record_session,

{kernel-0.87.0 → kernel-0.88.0}/src/kernel/resources/browsers/browsers.py

@@ -97,6 +97,7 @@ from ...lib.browser_routing.raw_http import (
 from ...types.browser_create_response import BrowserCreateResponse
 from ...types.browser_update_response import BrowserUpdateResponse
 from ...types.browser_retrieve_response import BrowserRetrieveResponse
+from ...types.browser_proxy_config_param import BrowserProxyConfigParam
 from ...types.shared_params.browser_profile import BrowserProfile
 from ...types.shared_params.browser_viewport import BrowserViewport
 from ...types.shared_params.browser_extension import BrowserExtension
@@ -172,6 +173,7 @@ class BrowsersResource(SyncAPIResource):
         kiosk_mode: bool | Omit = omit,
         name: str | Omit = omit,
         profile: BrowserProfile | Omit = omit,
+        proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: str | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
@@ -216,15 +218,26 @@ class BrowsersResource(SyncAPIResource):
               specified, the matching profile will be loaded into the browser session.
               Profiles must be created beforehand.
 
+          proxy: Proxy configuration for the browser session. Cannot be combined with proxy_id.
+              Omit to use the browser default: stealth browsers use Kernel's default stealth
+              proxy, while non-stealth browsers use direct egress. Set mode to direct to force
+              direct egress regardless of stealth. Set mode to default to explicitly use the
+              browser default: Kernel's default stealth proxy when stealth=true, or direct
+              egress when stealth=false. Select id or name to use that proxy regardless of
+              stealth. Proxy selection does not change stealth or CAPTCHA solver behavior.
+
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
-              the same project as the browser session.
+              the same project as the browser session. Deprecated in favor of proxy.
 
           start_url: Optional URL to open when the browser session is created. Navigation is
               best-effort, so navigation failures do not prevent the session from being
               created.
 
-          stealth: If true, launches the browser in stealth mode to reduce detection by anti-bot
-              mechanisms.
+          stealth: If true, launches the browser in stealth mode and enables the CAPTCHA solver.
+              Defaults to false. When proxy is omitted, stealth browsers use Kernel's default
+              stealth proxy and non-stealth browsers use direct egress. An explicit proxy
+              configuration changes only egress; it does not enable or disable stealth or the
+              CAPTCHA solver.
 
           tags: Optional user-defined key-value tags for the browser session, used to find and
               group sessions later. Can be changed later via PATCH /browsers/{id_or_name}. Up
@@ -275,6 +288,7 @@ class BrowsersResource(SyncAPIResource):
                     "kiosk_mode": kiosk_mode,
                     "name": name,
                     "profile": profile,
+                    "proxy": proxy,
                     "proxy_id": proxy_id,
                     "start_url": start_url,
                     "stealth": stealth,
@@ -340,6 +354,7 @@ class BrowsersResource(SyncAPIResource):
         disable_default_proxy: bool | Omit = omit,
         name: Optional[str] | Omit = omit,
         profile: BrowserProfile | Omit = omit,
+        proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: Optional[str] | Omit = omit,
         tags: Optional[TagsParam] | Omit = omit,
         telemetry: Optional[browser_update_params.Telemetry] | Omit = omit,
@@ -356,7 +371,7 @@ class BrowsersResource(SyncAPIResource):
 
         Args:
           disable_default_proxy: If true, stealth browsers connect directly instead of using the default stealth
-              proxy.
+              proxy. Deprecated in favor of proxy.mode.
 
           name: Human-readable name for the browser session. Omit to leave unchanged, set to an
               empty string to clear the name. When set, must be unique among active sessions
@@ -365,8 +380,15 @@ class BrowsersResource(SyncAPIResource):
           profile: Profile to load into the browser session. Only allowed if the session does not
               already have a profile loaded.
 
+          proxy: Proxy configuration to apply. Omit to leave the current configuration unchanged.
+              Cannot be combined with proxy_id or disable_default_proxy. Set mode to direct to
+              switch to direct egress regardless of stealth. Set mode to default to restore
+              the browser default after using a selected proxy: Kernel's default stealth proxy
+              for a stealth browser, or direct egress for a non-stealth browser. Updating
+              proxy does not change stealth or CAPTCHA solver behavior.
+
           proxy_id: ID of the proxy to use. Omit to leave unchanged, set to empty string to remove
-              proxy.
+              proxy. Deprecated in favor of proxy.
 
           tags: User-defined key-value tags for the browser session. Omit to leave unchanged.
               Provide a map to replace the entire tag set (full replace, not a merge). Set to
@@ -397,6 +419,7 @@ class BrowsersResource(SyncAPIResource):
                     "disable_default_proxy": disable_default_proxy,
                     "name": name,
                     "profile": profile,
+                    "proxy": proxy,
                     "proxy_id": proxy_id,
                     "tags": tags,
                     "telemetry": telemetry,
@@ -750,6 +773,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
         kiosk_mode: bool | Omit = omit,
         name: str | Omit = omit,
         profile: BrowserProfile | Omit = omit,
+        proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: str | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
@@ -794,15 +818,26 @@ class AsyncBrowsersResource(AsyncAPIResource):
               specified, the matching profile will be loaded into the browser session.
               Profiles must be created beforehand.
 
+          proxy: Proxy configuration for the browser session. Cannot be combined with proxy_id.
+              Omit to use the browser default: stealth browsers use Kernel's default stealth
+              proxy, while non-stealth browsers use direct egress. Set mode to direct to force
+              direct egress regardless of stealth. Set mode to default to explicitly use the
+              browser default: Kernel's default stealth proxy when stealth=true, or direct
+              egress when stealth=false. Select id or name to use that proxy regardless of
+              stealth. Proxy selection does not change stealth or CAPTCHA solver behavior.
+
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
-              the same project as the browser session.
+              the same project as the browser session. Deprecated in favor of proxy.
 
           start_url: Optional URL to open when the browser session is created. Navigation is
               best-effort, so navigation failures do not prevent the session from being
               created.
 
-          stealth: If true, launches the browser in stealth mode to reduce detection by anti-bot
-              mechanisms.
+          stealth: If true, launches the browser in stealth mode and enables the CAPTCHA solver.
+              Defaults to false. When proxy is omitted, stealth browsers use Kernel's default
+              stealth proxy and non-stealth browsers use direct egress. An explicit proxy
+              configuration changes only egress; it does not enable or disable stealth or the
+              CAPTCHA solver.
 
           tags: Optional user-defined key-value tags for the browser session, used to find and
               group sessions later. Can be changed later via PATCH /browsers/{id_or_name}. Up
@@ -853,6 +888,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
                     "kiosk_mode": kiosk_mode,
                     "name": name,
                     "profile": profile,
+                    "proxy": proxy,
                     "proxy_id": proxy_id,
                     "start_url": start_url,
                     "stealth": stealth,
@@ -918,6 +954,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
         disable_default_proxy: bool | Omit = omit,
         name: Optional[str] | Omit = omit,
         profile: BrowserProfile | Omit = omit,
+        proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: Optional[str] | Omit = omit,
         tags: Optional[TagsParam] | Omit = omit,
         telemetry: Optional[browser_update_params.Telemetry] | Omit = omit,
@@ -934,7 +971,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
 
         Args:
           disable_default_proxy: If true, stealth browsers connect directly instead of using the default stealth
-              proxy.
+              proxy. Deprecated in favor of proxy.mode.
 
           name: Human-readable name for the browser session. Omit to leave unchanged, set to an
               empty string to clear the name. When set, must be unique among active sessions
@@ -943,8 +980,15 @@ class AsyncBrowsersResource(AsyncAPIResource):
           profile: Profile to load into the browser session. Only allowed if the session does not
               already have a profile loaded.
 
+          proxy: Proxy configuration to apply. Omit to leave the current configuration unchanged.
+              Cannot be combined with proxy_id or disable_default_proxy. Set mode to direct to
+              switch to direct egress regardless of stealth. Set mode to default to restore
+              the browser default after using a selected proxy: Kernel's default stealth proxy
+              for a stealth browser, or direct egress for a non-stealth browser. Updating
+              proxy does not change stealth or CAPTCHA solver behavior.
+
           proxy_id: ID of the proxy to use. Omit to leave unchanged, set to empty string to remove
-              proxy.
+              proxy. Deprecated in favor of proxy.
 
           tags: User-defined key-value tags for the browser session. Omit to leave unchanged.
               Provide a map to replace the entire tag set (full replace, not a merge). Set to
@@ -975,6 +1019,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
                     "disable_default_proxy": disable_default_proxy,
                     "name": name,
                     "profile": profile,
+                    "proxy": proxy,
                     "proxy_id": proxy_id,
                     "tags": tags,
                     "telemetry": telemetry,

{kernel-0.87.0 → kernel-0.88.0}/src/kernel/types/__init__.py

@@ -22,6 +22,7 @@ from .project import Project as Project
 from .credential import Credential as Credential
 from .tags_param import TagsParam as TagsParam
 from .browser_pool import BrowserPool as BrowserPool
+from .browser_proxy import BrowserProxy as BrowserProxy
 from .browser_usage import BrowserUsage as BrowserUsage
 from .app_list_params import AppListParams as AppListParams
 from .audit_log_entry import AuditLogEntry as AuditLogEntry
@@ -29,6 +30,7 @@ from .created_api_key import CreatedAPIKey as CreatedAPIKey
 from .browser_pool_ref import BrowserPoolRef as BrowserPoolRef
 from .app_list_response import AppListResponse as AppListResponse
 from .proxy_list_params import ProxyListParams as ProxyListParams
+from .browser_proxy_mode import BrowserProxyMode as BrowserProxyMode
 from .proxy_check_params import ProxyCheckParams as ProxyCheckParams
 from .api_key_list_params import APIKeyListParams as APIKeyListParams
 from .browser_curl_params import BrowserCurlParams as BrowserCurlParams
@@ -39,6 +41,7 @@ from .project_list_params import ProjectListParams as ProjectListParams
 from .proxy_create_params import ProxyCreateParams as ProxyCreateParams
 from .proxy_list_response import ProxyListResponse as ProxyListResponse
 from .proxy_update_params import ProxyUpdateParams as ProxyUpdateParams
+from .browser_proxy_config import BrowserProxyConfig as BrowserProxyConfig
 from .proxy_check_response import ProxyCheckResponse as ProxyCheckResponse
 from .api_key_create_params import APIKeyCreateParams as APIKeyCreateParams
 from .api_key_rotate_params import APIKeyRotateParams as APIKeyRotateParams
@@ -85,6 +88,7 @@ from .extension_upload_response import ExtensionUploadResponse as ExtensionUploa
 from .browser_pool_create_params import BrowserPoolCreateParams as BrowserPoolCreateParams
 from .browser_pool_delete_params import BrowserPoolDeleteParams as BrowserPoolDeleteParams
 from .browser_pool_update_params import BrowserPoolUpdateParams as BrowserPoolUpdateParams
+from .browser_proxy_config_param import BrowserProxyConfigParam as BrowserProxyConfigParam
 from .deployment_create_response import DeploymentCreateResponse as DeploymentCreateResponse
 from .deployment_follow_response import DeploymentFollowResponse as DeploymentFollowResponse
 from .invocation_create_response import InvocationCreateResponse as InvocationCreateResponse

{kernel-0.87.0 → kernel-0.88.0}/src/kernel/types/auth/__init__.py

@@ -13,4 +13,6 @@ from .connection_submit_params import ConnectionSubmitParams as ConnectionSubmit
 from .connection_update_params import ConnectionUpdateParams as ConnectionUpdateParams
 from .connection_follow_response import ConnectionFollowResponse as ConnectionFollowResponse
 from .connection_timeline_params import ConnectionTimelineParams as ConnectionTimelineParams
+from .managed_auth_browser_config import ManagedAuthBrowserConfig as ManagedAuthBrowserConfig
 from .managed_auth_timeline_event import ManagedAuthTimelineEvent as ManagedAuthTimelineEvent
+from .managed_auth_browser_config_param import ManagedAuthBrowserConfigParam as ManagedAuthBrowserConfigParam

{kernel-0.87.0 → kernel-0.88.0}/src/kernel/types/auth/connection_create_params.py

@@ -6,6 +6,7 @@ from typing import Optional
 from typing_extensions import Required, TypedDict
 
 from ..._types import SequenceNotStr
+from .managed_auth_browser_config_param import ManagedAuthBrowserConfigParam
 from ..browsers.browser_telemetry_categories_config_param import BrowserTelemetryCategoriesConfigParam
 
 __all__ = [
@@ -62,11 +63,16 @@ class ConnectionCreateParams(TypedDict, total=False):
     re-auth. Defaults to true.
     """
 
-    browser_telemetry: Optional[BrowserTelemetry]
+    browser: ManagedAuthBrowserConfigParam
+    """
+    Default browser configuration for login, reauthentication, and health-check
+    sessions.
     """
-    Browser telemetry configuration used by this connection's browser sessions by
-    default. Uses the exact create-browser configuration. Can be overridden
-    per-login.
+
+    browser_telemetry: Optional[BrowserTelemetry]
+    """Deprecated.
+
+    Use browser.telemetry. Retained during migration for existing clients.
     """
 
     credential: Credential
@@ -82,8 +88,9 @@ class ConnectionCreateParams(TypedDict, total=False):
 
     When set, the system periodically verifies the authentication status and
     triggers re-authentication if needed. Maximum is 86400 (24 hours). Default is
-    3600 (1 hour). The minimum depends on your plan: Enterprise: 300 (5 minutes),
-    Startup: 1200 (20 minutes), Hobbyist: 3600 (1 hour).
+    3600 (1 hour) or your plan minimum, whichever is larger. The minimum depends on
+    your plan: Enterprise: 300 (5 minutes), Startup: 1200 (20 minutes), Hobbyist:
+    3600 (1 hour), Free: 21600 (6 hours).
     """
 
     health_checks: bool
@@ -98,13 +105,7 @@ class ConnectionCreateParams(TypedDict, total=False):
     """Optional login page URL to skip discovery"""
 
     proxy: Proxy
-    """Proxy selection.
-
-    Provide either id or name. The proxy must be in the same project as the resource
-    referencing it. When selecting by name, the name must match exactly one active
-    proxy in the project. Ambiguous names return a 400; use id for stable
-    references.
-    """
+    """Deprecated. Use browser.proxy. Retained during migration for existing clients."""
 
     record_session: bool
     """Whether to record browser sessions for this connection by default.
@@ -164,8 +165,9 @@ class BrowserTelemetryExport(TypedDict, total=False):
 
 
 class BrowserTelemetry(TypedDict, total=False):
-    """
-    Browser telemetry configuration used by this connection's browser sessions by default. Uses the exact create-browser configuration. Can be overridden per-login.
+    """Deprecated.
+
+    Use browser.telemetry. Retained during migration for existing clients.
     """
 
     browser: BrowserTelemetryCategoriesConfigParam
@@ -225,11 +227,7 @@ class Credential(TypedDict, total=False):
 
 
 class Proxy(TypedDict, total=False):
-    """Proxy selection.
-
-    Provide either id or name. The proxy must be in the same project as the resource referencing it.
-    When selecting by name, the name must match exactly one active proxy in the project. Ambiguous names return a 400; use id for stable references.
-    """
+    """Deprecated. Use browser.proxy. Retained during migration for existing clients."""
 
     id: str
     """Proxy ID"""