kernel 0.94.0__tar.gz → 0.95.0__tar.gz

kernel-0.95.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.95.0"
+}

{kernel-0.94.0 → kernel-0.95.0}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.95.0](https://github.com/kernel/kernel-python-sdk/compare/v0.94.0...v0.95.0) (2026-08-26)
+
+
+### Features
+
+* Add OTLP destination delivery health storage ([516cbce](https://github.com/kernel/kernel-python-sdk/commit/516cbce77afab43b346d9e95df2e4a25757c474b))
+* route process calls directly to browser VMs ([f833c55](https://github.com/kernel/kernel-python-sdk/commit/f833c55fee9e7c33c444af6366890a9c876e149c))
+
 ## [0.94.0](https://github.com/kernel/kernel-python-sdk/compare/v0.93.0...v0.94.0) (2026-08-24)
 
 

{kernel-0.94.0 → kernel-0.95.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.94.0
+Version: 0.95.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.94.0 → kernel-0.95.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.94.0"
+version = "0.95.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.94.0"  # x-release-please-version
+__version__ = "0.95.0"  # x-release-please-version

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/lib/browser_routing/routing.py

@@ -44,7 +44,7 @@ def browser_routing_config_from_env() -> BrowserRoutingConfig:
         # Path prefixes eligible for direct-to-VM routing. "telemetry/stream" is
         # the live SSE endpoint (VM); "telemetry/events" is a historical read
         # served by the control plane (S2) and must NOT be here.
-        return BrowserRoutingConfig(subresources=("curl", "telemetry/stream", "computer", "playwright"))
+        return BrowserRoutingConfig(subresources=("curl", "telemetry/stream", "computer", "playwright", "process"))
     if raw.strip() == "":
         return BrowserRoutingConfig()
 

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/resources/auth/connections.py

@@ -95,8 +95,10 @@ class ConnectionsResource(SyncAPIResource):
           profile_name: Name of the profile to manage authentication for. If the profile does not exist,
               it is created automatically.
 
-          allowed_domains: Additional domains valid for this auth flow (besides the primary domain). Useful
-              when login pages redirect to different domains.
+          allowed_domains: Additional hostname roots valid for this auth flow, besides the primary domain.
+              Each value allows credential entry on that exact hostname and its subdomains.
+              Leading `www.` and `*.` labels are normalized away. When omitted or empty,
+              credential entry is unrestricted.
 
               The following SSO/OAuth provider domains are automatically allowed by default
               and do not need to be specified:
@@ -254,7 +256,10 @@ class ConnectionsResource(SyncAPIResource):
         updated.
 
         Args:
-          allowed_domains: Additional domains valid for this auth flow (replaces existing list)
+          allowed_domains: Additional hostname roots valid for this auth flow. Each value allows credential
+              entry on that exact hostname and its subdomains; leading `www.` and `*.` labels
+              are normalized away. An empty list leaves credential entry unrestricted.
+              Replaces the existing list.
 
           auto_reauth: Whether automatic re-authentication is permitted for this connection. This is an
               opt-in flag only — it does not check whether re-auth is actually feasible. Even
@@ -713,8 +718,10 @@ class AsyncConnectionsResource(AsyncAPIResource):
           profile_name: Name of the profile to manage authentication for. If the profile does not exist,
               it is created automatically.
 
-          allowed_domains: Additional domains valid for this auth flow (besides the primary domain). Useful
-              when login pages redirect to different domains.
+          allowed_domains: Additional hostname roots valid for this auth flow, besides the primary domain.
+              Each value allows credential entry on that exact hostname and its subdomains.
+              Leading `www.` and `*.` labels are normalized away. When omitted or empty,
+              credential entry is unrestricted.
 
               The following SSO/OAuth provider domains are automatically allowed by default
               and do not need to be specified:
@@ -872,7 +879,10 @@ class AsyncConnectionsResource(AsyncAPIResource):
         updated.
 
         Args:
-          allowed_domains: Additional domains valid for this auth flow (replaces existing list)
+          allowed_domains: Additional hostname roots valid for this auth flow. Each value allows credential
+              entry on that exact hostname and its subdomains; leading `www.` and `*.` labels
+              are normalized away. An empty list leaves credential entry unrestricted.
+              Replaces the existing list.
 
           auto_reauth: Whether automatic re-authentication is permitted for this connection. This is an
               opt-in flag only — it does not check whether re-auth is actually feasible. Even

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/resources/browser_pools.py

@@ -73,7 +73,7 @@ class BrowserPoolsResource(SyncAPIResource):
         profile: browser_pool_create_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
         refresh_on_profile_update: bool | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         telemetry: Optional[browser_pool_create_params.Telemetry] | Omit = omit,
@@ -406,7 +406,7 @@ class BrowserPoolsResource(SyncAPIResource):
         name: str | Omit = omit,
         offset: int | Omit = omit,
         query: str | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -703,7 +703,7 @@ class AsyncBrowserPoolsResource(AsyncAPIResource):
         profile: browser_pool_create_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
         refresh_on_profile_update: bool | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         telemetry: Optional[browser_pool_create_params.Telemetry] | Omit = omit,
@@ -1036,7 +1036,7 @@ class AsyncBrowserPoolsResource(AsyncAPIResource):
         name: str | Omit = omit,
         offset: int | Omit = omit,
         query: str | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/resources/browsers/browsers.py

@@ -182,7 +182,7 @@ class BrowsersResource(SyncAPIResource):
         profile: BrowserProfile | Omit = omit,
         proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: str | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         tags: TagsParam | Omit = omit,
@@ -459,7 +459,7 @@ class BrowsersResource(SyncAPIResource):
         limit: int | Omit = omit,
         offset: int | Omit = omit,
         query: str | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         status: Literal["active", "deleted", "all"] | Omit = omit,
         tags: Dict[str, str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -694,8 +694,8 @@ class BrowsersResource(SyncAPIResource):
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> None:
         """
-        Loads one or more unpacked extensions and restarts Chromium on the browser
-        instance.
+        Loads one or more unpacked extensions using live CDP activation when eligible.
+        Chromium restarts when enterprise policy requires it or live activation fails.
 
         Args:
           extensions: List of extensions to upload and activate
@@ -802,7 +802,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
         profile: BrowserProfile | Omit = omit,
         proxy: BrowserProxyConfigParam | Omit = omit,
         proxy_id: str | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         tags: TagsParam | Omit = omit,
@@ -1079,7 +1079,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
         limit: int | Omit = omit,
         offset: int | Omit = omit,
         query: str | Omit = omit,
-        region: Literal["us-east", "eu-west"] | Omit = omit,
+        region: Literal["us-east", "eu-west", "ap-southeast"] | Omit = omit,
         status: Literal["active", "deleted", "all"] | Omit = omit,
         tags: Dict[str, str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -1314,8 +1314,8 @@ class AsyncBrowsersResource(AsyncAPIResource):
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> None:
         """
-        Loads one or more unpacked extensions and restarts Chromium on the browser
-        instance.
+        Loads one or more unpacked extensions using live CDP activation when eligible.
+        Chromium restarts when enterprise policy requires it or live activation fails.
 
         Args:
           extensions: List of extensions to upload and activate

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/auth/connection_create_params.py

@@ -31,9 +31,11 @@ class ConnectionCreateParams(TypedDict, total=False):
     """
 
     allowed_domains: SequenceNotStr[str]
-    """Additional domains valid for this auth flow (besides the primary domain).
+    """Additional hostname roots valid for this auth flow, besides the primary domain.
 
-    Useful when login pages redirect to different domains.
+    Each value allows credential entry on that exact hostname and its subdomains.
+    Leading `www.` and `*.` labels are normalized away. When omitted or empty,
+    credential entry is unrestricted.
 
     The following SSO/OAuth provider domains are automatically allowed by default
     and do not need to be specified:

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/auth/connection_update_params.py

@@ -22,7 +22,12 @@ __all__ = [
 
 class ConnectionUpdateParams(TypedDict, total=False):
     allowed_domains: SequenceNotStr[str]
-    """Additional domains valid for this auth flow (replaces existing list)"""
+    """Additional hostname roots valid for this auth flow.
+
+    Each value allows credential entry on that exact hostname and its subdomains;
+    leading `www.` and `*.` labels are normalized away. An empty list leaves
+    credential entry unrestricted. Replaces the existing list.
+    """
 
     auto_reauth: bool
     """Whether automatic re-authentication is permitted for this connection.

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/auth/managed_auth.py

@@ -309,9 +309,11 @@ class ManagedAuth(BaseModel):
     """Current authentication status of the managed profile"""
 
     allowed_domains: Optional[List[str]] = None
-    """
-    Additional domains that are valid for this auth flow (besides the primary
-    domain). Useful when login pages redirect to different domains.
+    """Additional hostname roots valid for this auth flow, besides the primary domain.
+
+    Each value allows credential entry on that exact hostname and its subdomains.
+    Leading `www.` and `*.` labels are normalized away. When omitted or empty,
+    credential entry is unrestricted.
 
     The following SSO/OAuth provider domains are automatically allowed by default
     and do not need to be specified:

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_create_params.py

@@ -101,7 +101,7 @@ class BrowserCreateParams(TypedDict, total=False):
     favor of proxy.
     """
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region for the browser session.
 
     It is fixed once the session is created. Region selection requires a Start-Up or

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_create_response.py

@@ -31,7 +31,7 @@ class BrowserCreateResponse(BaseModel):
     memory: BrowserMemory
     """Memory allocated to the browser session."""
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region of the browser session. Fixed once the session is created."""
 
     session_id: str

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_list_params.py

@@ -27,7 +27,7 @@ class BrowserListParams(TypedDict, total=False):
     Search browsers by name, session ID, profile name or ID, proxy ID, or pool name.
     """
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Filter sessions by geographic region. Omit to list sessions in all regions."""
 
     status: Literal["active", "deleted", "all"]

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_list_response.py

@@ -31,7 +31,7 @@ class BrowserListResponse(BaseModel):
     memory: BrowserMemory
     """Memory allocated to the browser session."""
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region of the browser session. Fixed once the session is created."""
 
     session_id: str

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_pool.py

@@ -174,7 +174,7 @@ class BrowserPool(BaseModel):
     (echoed as sent on create).
     """
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region of the browser pool. Fixed once the pool is created."""
 
     name: Optional[str] = None

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_pool_acquire_response.py

@@ -31,7 +31,7 @@ class BrowserPoolAcquireResponse(BaseModel):
     memory: BrowserMemory
     """Memory allocated to the browser session."""
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region of the browser session. Fixed once the session is created."""
 
     session_id: str

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_pool_create_params.py

@@ -87,7 +87,7 @@ class BrowserPoolCreateParams(TypedDict, total=False):
     creation, this defaults to true. Requires a profile to be set on the pool.
     """
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region for the browser pool.
 
     It is fixed once the pool is created. Region selection requires a Start-Up or

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_pool_list_params.py

@@ -28,5 +28,5 @@ class BrowserPoolListParams(TypedDict, total=False):
     IDs match by exact value.
     """
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Filter pools by geographic region. Omit to list pools in all regions."""

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_retrieve_response.py

@@ -31,7 +31,7 @@ class BrowserRetrieveResponse(BaseModel):
     memory: BrowserMemory
     """Memory allocated to the browser session."""
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region of the browser session. Fixed once the session is created."""
 
     session_id: str

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/browser_update_response.py

@@ -31,7 +31,7 @@ class BrowserUpdateResponse(BaseModel):
     memory: BrowserMemory
     """Memory allocated to the browser session."""
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region of the browser session. Fixed once the session is created."""
 
     session_id: str

{kernel-0.94.0 → kernel-0.95.0}/src/kernel/types/invocation_list_browsers_response.py

@@ -31,7 +31,7 @@ class Browser(BaseModel):
     memory: BrowserMemory
     """Memory allocated to the browser session."""
 
-    region: Literal["us-east", "eu-west"]
+    region: Literal["us-east", "eu-west", "ap-southeast"]
     """Geographic region of the browser session. Fixed once the session is created."""
 
     session_id: str

{kernel-0.94.0 → kernel-0.95.0}/tests/test_browser_routing.py

@@ -397,6 +397,7 @@ def test_browser_routing_config_from_env_defaults(monkeypatch: pytest.MonkeyPatc
         "telemetry/stream",
         "computer",
         "playwright",
+        "process",
     )
 
 
@@ -406,7 +407,7 @@ def test_direct_vm_routing_allowlist_segment_boundary() -> None:
     # stream-prefixed-but-different path is not matched.
     from kernel.lib.browser_routing.routing import _matches_direct_vm_prefix
 
-    prefixes = ("curl", "telemetry/stream", "computer", "playwright")
+    prefixes = ("curl", "telemetry/stream", "computer", "playwright", "process")
     assert _matches_direct_vm_prefix("telemetry/stream", prefixes) is True
     assert _matches_direct_vm_prefix("telemetry/stream/x", prefixes) is True
     assert _matches_direct_vm_prefix("telemetry/events", prefixes) is False
@@ -415,7 +416,8 @@ def test_direct_vm_routing_allowlist_segment_boundary() -> None:
     assert _matches_direct_vm_prefix("curl/raw", prefixes) is True
     assert _matches_direct_vm_prefix("computer/screenshot", prefixes) is True
     assert _matches_direct_vm_prefix("playwright/execute", prefixes) is True
-    assert _matches_direct_vm_prefix("process/exec", prefixes) is False
+    assert _matches_direct_vm_prefix("process/exec", prefixes) is True
+    assert _matches_direct_vm_prefix("process/proc-1/stdout/stream", prefixes) is True
     assert _matches_direct_vm_prefix("fs/read", prefixes) is False
 
 
@@ -433,7 +435,7 @@ def test_rewrite_direct_vm_options_keeps_telemetry_events_on_control_plane() ->
 
     cache = BrowserRouteCache()
     cache.set(BrowserRoute(session_id="sess-1", base_url="http://browser-session.test/browser/kernel", jwt="token-abc"))
-    config = BrowserRoutingConfig(subresources=("curl", "telemetry/stream", "computer", "playwright"))
+    config = BrowserRoutingConfig(subresources=("curl", "telemetry/stream", "computer", "playwright", "process"))
 
     events = rewrite_direct_vm_options(
         FinalRequestOptions(method="get", url="/browsers/sess-1/telemetry/events"), cache=cache, config=config
@@ -458,7 +460,7 @@ def test_rewrite_direct_vm_options_keeps_telemetry_events_on_control_plane() ->
     process = rewrite_direct_vm_options(
         FinalRequestOptions(method="post", url="/browsers/sess-1/process/exec"), cache=cache, config=config
     )
-    assert process.url == "/browsers/sess-1/process/exec"
+    assert str(process.url).startswith("http://browser-session.test/browser/kernel/process/exec")
 
     fs_read = rewrite_direct_vm_options(
         FinalRequestOptions(method="get", url="/browsers/sess-1/fs/read_file"), cache=cache, config=config
@@ -472,7 +474,7 @@ def test_browser_routing_config_from_env_empty_string_disables_routing(monkeypat
 
 
 @respx.mock
-def test_computer_screenshot_and_playwright_execute_route_to_vm_by_default(
+def test_default_browser_subresources_route_to_vm(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     monkeypatch.delenv("KERNEL_BROWSER_ROUTING_SUBRESOURCES", raising=False)
@@ -482,10 +484,14 @@ def test_computer_screenshot_and_playwright_execute_route_to_vm_by_default(
     execute = respx.post("http://browser-session.test/browser/kernel/playwright/execute").mock(
         return_value=httpx.Response(200, json={"success": True})
     )
+    process = respx.post("http://browser-session.test/browser/kernel/process/exec").mock(
+        return_value=httpx.Response(200, json={"exit_code": 0, "stdout_b64": "", "stderr_b64": ""})
+    )
     with Kernel(base_url=base_url, api_key=api_key, _strict_response_validation=True) as client:
         _cache_browser(client)
         client.browsers.computer.capture_screenshot("sess-1")
         out = client.browsers.playwright.execute("sess-1", code="return 1")
+        process_out = client.browsers.process.exec("sess-1", command="echo")
 
     assert screenshot.called
     screenshot_req = cast(httpx.Request, cast(Any, screenshot.calls[0]).request)
@@ -495,28 +501,28 @@ def test_computer_screenshot_and_playwright_execute_route_to_vm_by_default(
     execute_req = cast(httpx.Request, cast(Any, execute.calls[0]).request)
     assert execute_req.url.params.get("jwt") == "token-abc"
     assert execute_req.headers.get("Authorization") is None
+    assert process.called
+    process_req = cast(httpx.Request, cast(Any, process.calls[0]).request)
+    assert process_req.url.params.get("jwt") == "token-abc"
+    assert process_req.headers.get("Authorization") is None
     assert out.success is True
+    assert process_out.exit_code == 0
 
 
 @respx.mock
-def test_process_fs_and_telemetry_events_stay_on_api_origin_by_default(
+def test_fs_and_telemetry_events_stay_on_api_origin_by_default(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     monkeypatch.delenv("KERNEL_BROWSER_ROUTING_SUBRESOURCES", raising=False)
-    process = respx.post(f"{base_url}/browsers/sess-1/process/exec").mock(
-        return_value=httpx.Response(200, json={"exit_code": 0, "stdout_b64": "", "stderr_b64": ""})
-    )
     fs_read = respx.get(f"{base_url}/browsers/sess-1/fs/read_file").mock(
         return_value=httpx.Response(200, content=b"x", headers={"content-type": "application/octet-stream"})
     )
     events = respx.get(f"{base_url}/browsers/sess-1/telemetry/events").mock(return_value=httpx.Response(200, json=[]))
     with Kernel(base_url=base_url, api_key=api_key, _strict_response_validation=True) as client:
         _cache_browser(client)
-        client.browsers.process.exec("sess-1", command="echo")
         client.browsers.fs.read_file("sess-1", path="/tmp/x")
         client.browsers.telemetry.events("sess-1")
 
-    assert process.called
     assert fs_read.called
     assert events.called
 

kernel-0.94.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.94.0"
-}