From 6201206cde485f7eb0421cf1f168863098218463 Mon Sep 17 00:00:00 2001 From: eclairen <236733058+eclairen@users.noreply.github.com> Date: Wed, 5 Aug 2026 23:38:23 +0000 Subject: [PATCH 1/7] Add August 7 changelog entry Cover the week's product updates: the Terraform provider release, the CUA CLI 0.9.0 / cua-agent + cua-ai 0.10.0 releases, the MCP server's managed auth login panel, MCP error transparency and tool-call context, browser session search by profile name, and the just-html viewer additions. Plus the two documentation updates from the same window. Co-Authored-By: Claude Opus 5 --- changelog.mdx | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/changelog.mdx b/changelog.mdx index 4eb1749..3632326 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -9,6 +9,23 @@ import { YouTubeVideo } from '/snippets/youtube-video.mdx'; For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-node-sdk/blob/main/CHANGELOG.md), [Python SDK](https://github.com/onkernel/kernel-python-sdk/blob/next/CHANGELOG.md), and [Go SDK](https://github.com/onkernel/kernel-go-sdk/blob/main/CHANGELOG.md) changelogs. + +## Product updates + +- Released the [Kernel Terraform provider](https://registry.terraform.io/providers/kernel/kernel/latest) on the Terraform Registry. Manage browser pools and projects as code, and reference existing profiles, proxies, and extensions as data sources. Install with `source = "kernel/kernel"`. +- Shipped CUA CLI 0.9.0 alongside [`@onkernel/cua-agent`](https://github.com/kernel/cua) and [`@onkernel/cua-ai`](https://github.com/kernel/cua) 0.10.0, adding an OpenRouter Kimi K3 computer-use provider, message queuing during active turns with cleaner interrupt handling, and Tzafon post-action screenshots. Also made cua-ai's catalog compilation declaration-only with a clearer execution boundary. Note for anyone embedding `cua-agent`: 0.10.0 upgrades the underlying `pi` stack to 0.83.0 and adopts its context-first harness API, which is a breaking change to `CuaAgentHarness`. +- Added a secure managed auth login panel to the [MCP server](/reference/mcp-server), exposed as a new `open_auth_login` tool. Agents hand the user an interactive panel to complete login and re-auth, so credentials and MFA codes never enter the conversation. `manage_auth_connections` gained a read-only `wait` action to follow a flow through to completion. +- Improved [MCP server](/reference/mcp-server) error transparency: Kernel API, Playwright, `exec_command`, and `search_docs` failures now surface as tool errors instead of being masked as successes, so agents can retry or route around them. The server also advertises the Kernel server name on `initialize`. +- MCP tool calls now carry a short `context` field describing what the agent is trying to accomplish, and the server reports capability gaps it runs into. We use both to prioritize what to build next. Credential shapes and other request specifics are redacted, and reports that arrive without context are dropped. +- Extended browser session search to match on profile name, not just profile ID — in `GET /browsers?query=` and in the dashboard sessions list. Search stays case-insensitive and scoped to your org and project. +- Added a logout button and an estimated read-time chip to [just-html](https://github.com/kernel/just-html) documents, so viewers know how long a doc will take and can sign out from the docs page directly. + +## Documentation updates + +- Added a `URLAllowlist` navigation-restriction example to the [Chrome policies](/browsers/chrome-policies) guide. +- Refreshed the [browser pools](/browsers/pools) guides and standardized on "browser pools" terminology across the docs. + + ## Product updates From 7ef83472e367ae5dceb85fbbdfc038c108c5d605 Mon Sep 17 00:00:00 2001 From: masnwilliams <43387599+masnwilliams@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:05:58 +0000 Subject: [PATCH 2/7] Add August 5 changelog updates --- changelog.mdx | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changelog.mdx b/changelog.mdx index 3632326..cca1923 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -13,11 +13,16 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n ## Product updates - Released the [Kernel Terraform provider](https://registry.terraform.io/providers/kernel/kernel/latest) on the Terraform Registry. Manage browser pools and projects as code, and reference existing profiles, proxies, and extensions as data sources. Install with `source = "kernel/kernel"`. +- Released [Hypeman v0.3.0](https://github.com/kernel/hypeman/releases/tag/v0.3.0) with persistent Builder resources and build caches, safer auto-standby through `POST /instances/{id}/auto-standby/hold`, and a new default API port of `4973`. Existing explicit port settings are unchanged. - Shipped CUA CLI 0.9.0 alongside [`@onkernel/cua-agent`](https://github.com/kernel/cua) and [`@onkernel/cua-ai`](https://github.com/kernel/cua) 0.10.0, adding an OpenRouter Kimi K3 computer-use provider, message queuing during active turns with cleaner interrupt handling, and Tzafon post-action screenshots. Also made cua-ai's catalog compilation declaration-only with a clearer execution boundary. Note for anyone embedding `cua-agent`: 0.10.0 upgrades the underlying `pi` stack to 0.83.0 and adopts its context-first harness API, which is a breaking change to `CuaAgentHarness`. - Added a secure managed auth login panel to the [MCP server](/reference/mcp-server), exposed as a new `open_auth_login` tool. Agents hand the user an interactive panel to complete login and re-auth, so credentials and MFA codes never enter the conversation. `manage_auth_connections` gained a read-only `wait` action to follow a flow through to completion. +- Protected managed auth connections from losing their configured egress: `DELETE /proxies/{id}` now returns `400 resource_in_use` when a live connection still references the proxy. Remove or repoint those connections before deleting the proxy. - Improved [MCP server](/reference/mcp-server) error transparency: Kernel API, Playwright, `exec_command`, and `search_docs` failures now surface as tool errors instead of being masked as successes, so agents can retry or route around them. The server also advertises the Kernel server name on `initialize`. - MCP tool calls now carry a short `context` field describing what the agent is trying to accomplish, and the server reports capability gaps it runs into. We use both to prioritize what to build next. Credential shapes and other request specifics are redacted, and reports that arrive without context are dropped. +- Added per-browser OTLP export destination selection to [browser telemetry](/browsers/telemetry). Set `telemetry.export.otlp.destination` when creating a browser to route captured events to an org-scoped destination, and inspect the live export state in browser responses. +- Allowed `CONNECT` tunnels to public destinations on non-standard ports while continuing to block SMTP port `25` and private or otherwise non-public addresses. - Extended browser session search to match on profile name, not just profile ID — in `GET /browsers?query=` and in the dashboard sessions list. Search stays case-insensitive and scoped to your org and project. +- Added a search button beside the dashboard organization selector, making the existing Cmd+K or Ctrl+K command palette discoverable on desktop and mobile. - Added a logout button and an estimated read-time chip to [just-html](https://github.com/kernel/just-html) documents, so viewers know how long a doc will take and can sign out from the docs page directly. ## Documentation updates From a746785ff6b1c68ad43cf9e9ebf7829e1b3e3bc0 Mon Sep 17 00:00:00 2001 From: masnwilliams <43387599+masnwilliams@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:11:31 +0000 Subject: [PATCH 3/7] Remove unrelated changelog item --- changelog.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/changelog.mdx b/changelog.mdx index cca1923..64a3425 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -23,7 +23,6 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n - Allowed `CONNECT` tunnels to public destinations on non-standard ports while continuing to block SMTP port `25` and private or otherwise non-public addresses. - Extended browser session search to match on profile name, not just profile ID — in `GET /browsers?query=` and in the dashboard sessions list. Search stays case-insensitive and scoped to your org and project. - Added a search button beside the dashboard organization selector, making the existing Cmd+K or Ctrl+K command palette discoverable on desktop and mobile. -- Added a logout button and an estimated read-time chip to [just-html](https://github.com/kernel/just-html) documents, so viewers know how long a doc will take and can sign out from the docs page directly. ## Documentation updates From 4feed1e80aad5406284b97958fc2f9da58f4dd84 Mon Sep 17 00:00:00 2001 From: masnwilliams <43387599+masnwilliams@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:18:42 +0000 Subject: [PATCH 4/7] Keep changelog customer-facing --- changelog.mdx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/changelog.mdx b/changelog.mdx index 64a3425..4495d8c 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -13,12 +13,11 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n ## Product updates - Released the [Kernel Terraform provider](https://registry.terraform.io/providers/kernel/kernel/latest) on the Terraform Registry. Manage browser pools and projects as code, and reference existing profiles, proxies, and extensions as data sources. Install with `source = "kernel/kernel"`. -- Released [Hypeman v0.3.0](https://github.com/kernel/hypeman/releases/tag/v0.3.0) with persistent Builder resources and build caches, safer auto-standby through `POST /instances/{id}/auto-standby/hold`, and a new default API port of `4973`. Existing explicit port settings are unchanged. - Shipped CUA CLI 0.9.0 alongside [`@onkernel/cua-agent`](https://github.com/kernel/cua) and [`@onkernel/cua-ai`](https://github.com/kernel/cua) 0.10.0, adding an OpenRouter Kimi K3 computer-use provider, message queuing during active turns with cleaner interrupt handling, and Tzafon post-action screenshots. Also made cua-ai's catalog compilation declaration-only with a clearer execution boundary. Note for anyone embedding `cua-agent`: 0.10.0 upgrades the underlying `pi` stack to 0.83.0 and adopts its context-first harness API, which is a breaking change to `CuaAgentHarness`. - Added a secure managed auth login panel to the [MCP server](/reference/mcp-server), exposed as a new `open_auth_login` tool. Agents hand the user an interactive panel to complete login and re-auth, so credentials and MFA codes never enter the conversation. `manage_auth_connections` gained a read-only `wait` action to follow a flow through to completion. - Protected managed auth connections from losing their configured egress: `DELETE /proxies/{id}` now returns `400 resource_in_use` when a live connection still references the proxy. Remove or repoint those connections before deleting the proxy. - Improved [MCP server](/reference/mcp-server) error transparency: Kernel API, Playwright, `exec_command`, and `search_docs` failures now surface as tool errors instead of being masked as successes, so agents can retry or route around them. The server also advertises the Kernel server name on `initialize`. -- MCP tool calls now carry a short `context` field describing what the agent is trying to accomplish, and the server reports capability gaps it runs into. We use both to prioritize what to build next. Credential shapes and other request specifics are redacted, and reports that arrive without context are dropped. +- MCP tool calls now require a short `context` field describing what the agent is trying to accomplish, with credential shapes and other request details excluded. - Added per-browser OTLP export destination selection to [browser telemetry](/browsers/telemetry). Set `telemetry.export.otlp.destination` when creating a browser to route captured events to an org-scoped destination, and inspect the live export state in browser responses. - Allowed `CONNECT` tunnels to public destinations on non-standard ports while continuing to block SMTP port `25` and private or otherwise non-public addresses. - Extended browser session search to match on profile name, not just profile ID — in `GET /browsers?query=` and in the dashboard sessions list. Search stays case-insensitive and scoped to your org and project. From b1dfc29a784bc12285309f35a51d090bb702aedf Mon Sep 17 00:00:00 2001 From: masnwilliams <43387599+masnwilliams@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:21:17 +0000 Subject: [PATCH 5/7] Restore Hypeman changelog update --- changelog.mdx | 1 + 1 file changed, 1 insertion(+) diff --git a/changelog.mdx b/changelog.mdx index 4495d8c..3a7258f 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -13,6 +13,7 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n ## Product updates - Released the [Kernel Terraform provider](https://registry.terraform.io/providers/kernel/kernel/latest) on the Terraform Registry. Manage browser pools and projects as code, and reference existing profiles, proxies, and extensions as data sources. Install with `source = "kernel/kernel"`. +- Released [Hypeman v0.3.0](https://github.com/kernel/hypeman/releases/tag/v0.3.0) with persistent Builder resources and build caches, safer auto-standby through `POST /instances/{id}/auto-standby/hold`, and a new default API port of `4973`. Existing explicit port settings are unchanged. - Shipped CUA CLI 0.9.0 alongside [`@onkernel/cua-agent`](https://github.com/kernel/cua) and [`@onkernel/cua-ai`](https://github.com/kernel/cua) 0.10.0, adding an OpenRouter Kimi K3 computer-use provider, message queuing during active turns with cleaner interrupt handling, and Tzafon post-action screenshots. Also made cua-ai's catalog compilation declaration-only with a clearer execution boundary. Note for anyone embedding `cua-agent`: 0.10.0 upgrades the underlying `pi` stack to 0.83.0 and adopts its context-first harness API, which is a breaking change to `CuaAgentHarness`. - Added a secure managed auth login panel to the [MCP server](/reference/mcp-server), exposed as a new `open_auth_login` tool. Agents hand the user an interactive panel to complete login and re-auth, so credentials and MFA codes never enter the conversation. `manage_auth_connections` gained a read-only `wait` action to follow a flow through to completion. - Protected managed auth connections from losing their configured egress: `DELETE /proxies/{id}` now returns `400 resource_in_use` when a live connection still references the proxy. Remove or repoint those connections before deleting the proxy. From 283c50a7cb2e3083d08f2fa36f51842b4ebb747e Mon Sep 17 00:00:00 2001 From: masnwilliams <43387599+masnwilliams@users.noreply.github.com> Date: Thu, 6 Aug 2026 20:04:29 +0000 Subject: [PATCH 6/7] Finalize August 7 changelog --- changelog.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/changelog.mdx b/changelog.mdx index 3a7258f..46cd7c9 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -13,7 +13,7 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n ## Product updates - Released the [Kernel Terraform provider](https://registry.terraform.io/providers/kernel/kernel/latest) on the Terraform Registry. Manage browser pools and projects as code, and reference existing profiles, proxies, and extensions as data sources. Install with `source = "kernel/kernel"`. -- Released [Hypeman v0.3.0](https://github.com/kernel/hypeman/releases/tag/v0.3.0) with persistent Builder resources and build caches, safer auto-standby through `POST /instances/{id}/auto-standby/hold`, and a new default API port of `4973`. Existing explicit port settings are unchanged. +- Released [Hypeman v0.3.0](https://github.com/kernel/hypeman/releases/tag/v0.3.0) with persistent Builder resources and build caches, safer auto-standby through `POST /instances/{id}/auto-standby/hold`, and a new default API port of `4973`. Existing explicit port settings are unchanged. [Hypeman CLI v0.17.0](https://github.com/kernel/hypeman-cli/releases/tag/v0.17.0) adds `builder create`, `list`, `get`, `delete`, and `prune` commands, plus `hypeman build --builder` for cache reuse. - Shipped CUA CLI 0.9.0 alongside [`@onkernel/cua-agent`](https://github.com/kernel/cua) and [`@onkernel/cua-ai`](https://github.com/kernel/cua) 0.10.0, adding an OpenRouter Kimi K3 computer-use provider, message queuing during active turns with cleaner interrupt handling, and Tzafon post-action screenshots. Also made cua-ai's catalog compilation declaration-only with a clearer execution boundary. Note for anyone embedding `cua-agent`: 0.10.0 upgrades the underlying `pi` stack to 0.83.0 and adopts its context-first harness API, which is a breaking change to `CuaAgentHarness`. - Added a secure managed auth login panel to the [MCP server](/reference/mcp-server), exposed as a new `open_auth_login` tool. Agents hand the user an interactive panel to complete login and re-auth, so credentials and MFA codes never enter the conversation. `manage_auth_connections` gained a read-only `wait` action to follow a flow through to completion. - Protected managed auth connections from losing their configured egress: `DELETE /proxies/{id}` now returns `400 resource_in_use` when a live connection still references the proxy. Remove or repoint those connections before deleting the proxy. @@ -21,11 +21,14 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n - MCP tool calls now require a short `context` field describing what the agent is trying to accomplish, with credential shapes and other request details excluded. - Added per-browser OTLP export destination selection to [browser telemetry](/browsers/telemetry). Set `telemetry.export.otlp.destination` when creating a browser to route captured events to an org-scoped destination, and inspect the live export state in browser responses. - Allowed `CONNECT` tunnels to public destinations on non-standard ports while continuing to block SMTP port `25` and private or otherwise non-public addresses. +- Improved browser egress reliability when an origin negotiates HTTP/2 during fallback by reusing the established connection instead of closing and redialing it. - Extended browser session search to match on profile name, not just profile ID — in `GET /browsers?query=` and in the dashboard sessions list. Search stays case-insensitive and scoped to your org and project. - Added a search button beside the dashboard organization selector, making the existing Cmd+K or Ctrl+K command palette discoverable on desktop and mobile. ## Documentation updates +- Launched [Hypeman documentation](https://docs.hypeman.sh) with getting-started guides and generated API, TypeScript SDK, and Go SDK references. +- Added a [Terraform integration guide](/integrations/terraform) covering provider setup, authentication, and where to find resources, examples, and releases. - Added a `URLAllowlist` navigation-restriction example to the [Chrome policies](/browsers/chrome-policies) guide. - Refreshed the [browser pools](/browsers/pools) guides and standardized on "browser pools" terminology across the docs. From 4cf732f894a770631d126f4de006f8ea7a1bb393 Mon Sep 17 00:00:00 2001 From: masnwilliams <43387599+masnwilliams@users.noreply.github.com> Date: Thu, 6 Aug 2026 20:09:58 +0000 Subject: [PATCH 7/7] Fix telemetry changelog link --- changelog.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog.mdx b/changelog.mdx index 46cd7c9..9a111d5 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -19,7 +19,7 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n - Protected managed auth connections from losing their configured egress: `DELETE /proxies/{id}` now returns `400 resource_in_use` when a live connection still references the proxy. Remove or repoint those connections before deleting the proxy. - Improved [MCP server](/reference/mcp-server) error transparency: Kernel API, Playwright, `exec_command`, and `search_docs` failures now surface as tool errors instead of being masked as successes, so agents can retry or route around them. The server also advertises the Kernel server name on `initialize`. - MCP tool calls now require a short `context` field describing what the agent is trying to accomplish, with credential shapes and other request details excluded. -- Added per-browser OTLP export destination selection to [browser telemetry](/browsers/telemetry). Set `telemetry.export.otlp.destination` when creating a browser to route captured events to an org-scoped destination, and inspect the live export state in browser responses. +- Added per-browser OTLP export destination selection to [browser telemetry](/browsers/telemetry/overview). Set `telemetry.export.otlp.destination` when creating a browser to route captured events to an org-scoped destination, and inspect the live export state in browser responses. - Allowed `CONNECT` tunnels to public destinations on non-standard ports while continuing to block SMTP port `25` and private or otherwise non-public addresses. - Improved browser egress reliability when an origin negotiates HTTP/2 during fallback by reusing the established connection instead of closing and redialing it. - Extended browser session search to match on profile name, not just profile ID — in `GET /browsers?query=` and in the dashboard sessions list. Search stays case-insensitive and scoped to your org and project.