CLI: Update SDK to f737b63ffd168cc67bf0158b961ca3275c94bd1c and add new commands/flags (#291)

This PR updates the Go SDK to f737b63ffd168cc67bf0158b961ca3275c94bd1c
and adds CLI commands/flags for new SDK methods.

## SDK Update
- Updated kernel-go-sdk to f737b63ffd168cc67bf0158b961ca3275c94bd1c
(v0.122.1-0.20261009181557-f737b63ffd16)
- The latest SDK commit (f737b63) only changes documentation for the
1Password fill result: `fill_unknown` can now carry `error_code:
autosubmitFailed`, and after an uncertain fill the caller should inspect
the page. The CLI already prints `error_code` for every `1pw_fill`
status, and its help text already gives this guidance, so no code
changes were needed for it.
- An earlier commit on this branch updated the SDK to
6f3ae15351013fd71e5d554b69d7e532e1e592db, which adds `video_memory` for
the 4GiB VRAM GPU browser tier.

## Coverage Analysis
This PR was generated by performing a full enumeration of SDK methods
and CLI commands. After this PR, every method in api.md has a CLI
command. The only exception is `ConfigRegistry.*`, which is skipped
because those endpoints are marked `x-cli-skip`.

## New Commands
- `kernel vaults get-encryption-key <vault>` for
`client.Vaults.GetEncryptionKey()`. It shows a table by default, and `-o
json` returns the raw key response.

## New Flags
- `--video-memory` on `kernel browsers create` for
`BrowserNewParams.VideoMemory`. It accepts `2GiB` (the default: 4 vCPU,
6GiB memory) or `4GiB` (8 vCPU, 12GiB memory), matched
case-insensitively and checked before the request is sent. It requires
`--gpu`. `browsers get` and `create` now show a "Video Memory" row when
the API returns one.
- The new `encrypted_value` field
(`CredentialVaultFieldInputParam.EncryptedValue`,
`CredentialVaultFieldUpdateParam.EncryptedValue`) goes through the
existing `--spec-file` JSON on `vaults credentials create/update`. The
help text and README now describe it.

## Testing
- f737b63 bump: `go build ./...`, `go vet ./...` and `go test ./...` all
pass.
- `browsers create --gpu --video-memory 2GiB -t 30`: the session was
created, and `browsers get` showed `GPU true`, `Memory 6GiB`, `Video
Memory 2GiB`. The test browser was deleted afterwards.
- `browsers create --gpu --video-memory 4GiB`: the API received the 4GiB
tier but returned `No_gpu_browsers_available` (at capacity), so no 4GiB
session was created.
- `--video-memory 3GiB` is rejected on the client with a clear error. A
new unit test, `TestBrowsersCreate_WithVideoMemory`, covers this.
- `vaults get-encryption-key`: table output, `-o json` output, and the
not-found error all checked.
- Created a credential with a real ECDH-ES/A256GCM JWE
`encrypted_value`. The item became ready, and the update bumped the
version from 1 to 2.

Triggered by:
kernel/kernel-go-sdk@f737b63
Reviewer: @kernel-internal[bot]

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Mostly new CLI flags/commands and docs atop the SDK; credential
encryption still flows through existing spec-file JSON without new local
crypto logic.
> 
> **Overview**
> Updates **kernel-go-sdk** and exposes two new API surfaces in the CLI.
> 
> Adds **`kernel vaults get-encryption-key`** so custom
credential-collection apps can fetch a vault’s public JWK (`kid`,
ECDH-ES / A256GCM) for browser-side JWE encryption, with table or `-o
json` output. README and **`vaults credentials`** help now document
**`encrypted_value`** as an alternative to **`value`** on create/update
specs (mutually exclusive).
> 
> Adds **`--video-memory`** on **`kernel browsers create`** (`2GiB` /
`4GiB`, case-insensitive client validation; omitted leaves the API
default). Create passes it through to **`BrowserNewParams`**, and
**`browsers get`/create detail** show **Video Memory** when present.
**`TestBrowsersCreate_WithVideoMemory`** covers mapping, omission, and
invalid sizes.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
456553a. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: kernel-internal[bot] <260533166+kernel-internal[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: kernel-internal[bot]

README.md

@@ -410,6 +410,7 @@ cannot switch projects.
 | `kernel vaults create --name <name>` | Create or retrieve the vault with that immutable name |
 | `kernel vaults list` | `--limit 1..100` (default 20), `--offset`, `--query` (name substring or exact ID); JSON includes `vaults` and optional `next_offset` |
 | `kernel vaults get <vault>` | Get by ID or name |
+| `kernel vaults get-encryption-key <vault>` | Get the public key custom collection apps use to send `encrypted_value` |
 | `kernel vaults delete <vault>` | Invalidate the vault and all its items; `--yes` skips confirmation |
 | `kernel vaults wallets create <vault> <key> --provider link\|agentcard --spec '<json>'` | Connect/enroll a wallet using its provider's spec; `--open` opens a returned HTTPS action URL |
 | `kernel vaults wallets payment-methods <vault> <key>` | Fetch advertised live payment methods; JSON is the item with `expanded.payment_methods` |

cmd/browsers.go

@@ -201,6 +201,26 @@ func parseMemoryFlag(memory string) (kernel.BrowserMemoryRequest, error) {
 	return "", fmt.Errorf("invalid --memory value: %s (must be one of %s)", memory, strings.Join(availableMemorySizes(), ", "))
 }
 
+// availableVideoMemorySizes returns the video memory (VRAM) sizes the API
+// accepts for a GPU browser session.
+func availableVideoMemorySizes() []string {
+	return []string{"2GiB", "4GiB"}
+}
+
+// parseVideoMemoryFlag validates a --video-memory value. An empty value means the
+// flag was not set, which lets the API apply its default (2GiB).
+func parseVideoMemoryFlag(videoMemory string) (kernel.BrowserVideoMemory, error) {
+	if videoMemory == "" {
+		return "", nil
+	}
+	for _, m := range availableVideoMemorySizes() {
+		if strings.EqualFold(videoMemory, m) {
+			return kernel.BrowserVideoMemory(m), nil
+		}
+	}
+	return "", fmt.Errorf("invalid --video-memory value: %s (must be one of %s)", videoMemory, strings.Join(availableVideoMemorySizes(), ", "))
+}
+
 // maxPrivateHosts mirrors the API's cap on network.private_hosts entries.
 const maxPrivateHosts = 32
 
@@ -468,6 +488,7 @@ type BrowsersCreateInput struct {
 	Headless            BoolFlag
 	GPU                 BoolFlag
 	Memory              string
+	VideoMemory         string
 	InvocationID        string
 	Kiosk               BoolFlag
 	ProfileID           string
@@ -705,6 +726,13 @@ func (b BrowsersCmd) Create(ctx context.Context, in BrowsersCreateInput) error {
 	if memory != "" {
 		params.Memory = memory
 	}
+	videoMemory, err := parseVideoMemoryFlag(in.VideoMemory)
+	if err != nil {
+		return err
+	}
+	if videoMemory != "" {
+		params.VideoMemory = videoMemory
+	}
 	if in.InvocationID != "" {
 		params.InvocationID = kernel.Opt(in.InvocationID)
 	}
@@ -972,6 +1000,9 @@ func (b BrowsersCmd) Get(ctx context.Context, in BrowsersGetInput) error {
 	tableData = append(tableData, []string{"Stealth", fmt.Sprintf("%t", browser.Stealth)})
 	tableData = append(tableData, []string{"GPU", fmt.Sprintf("%t", browser.GPU)})
 	tableData = append(tableData, []string{"Memory", util.OrDash(string(browser.Memory))})
+	if browser.VideoMemory != "" {
+		tableData = append(tableData, []string{"Video Memory", string(browser.VideoMemory)})
+	}
 	tableData = append(tableData, []string{"Kiosk Mode", fmt.Sprintf("%t", browser.KioskMode)})
 	if browser.Viewport.Width > 0 && browser.Viewport.Height > 0 {
 		viewportStr := fmt.Sprintf("%dx%d", browser.Viewport.Width, browser.Viewport.Height)
@@ -3247,6 +3278,7 @@ unrestricted code execution inside the browser VM and is not sandboxed.`,
 	browsersCreateCmd.Flags().BoolP("headless", "H", false, "Launch browser without GUI access")
 	browsersCreateCmd.Flags().Bool("gpu", false, "Launch browser with hardware-accelerated GPU rendering")
 	browsersCreateCmd.Flags().String("memory", "", "Memory for a headful, non-GPU browser session: '8GiB' (default) or '16GiB'")
+	browsersCreateCmd.Flags().String("video-memory", "", "Video memory (VRAM) for a GPU browser session (requires --gpu): '2GiB' (default, 4 vCPU/6GiB memory) or '4GiB' (8 vCPU/12GiB memory)")
 	browsersCreateCmd.Flags().String("invocation-id", "", "Associate the browser session with an invocation")
 	browsersCreateCmd.Flags().Bool("kiosk", false, "Launch browser in kiosk mode")
 	browsersCreateCmd.Flags().IntP("timeout", "t", 60, "Timeout in seconds for the browser session")
@@ -3387,6 +3419,7 @@ func runBrowsersCreate(cmd *cobra.Command, args []string) error {
 	headlessVal, _ := cmd.Flags().GetBool("headless")
 	gpuVal, _ := cmd.Flags().GetBool("gpu")
 	memory, _ := cmd.Flags().GetString("memory")
+	videoMemory, _ := cmd.Flags().GetString("video-memory")
 	invocationID, _ := cmd.Flags().GetString("invocation-id")
 	kioskVal, _ := cmd.Flags().GetBool("kiosk")
 	timeout, _ := cmd.Flags().GetInt("timeout")
@@ -3544,6 +3577,7 @@ func runBrowsersCreate(cmd *cobra.Command, args []string) error {
 		Headless:            BoolFlag{Set: cmd.Flags().Changed("headless"), Value: headlessVal},
 		GPU:                 BoolFlag{Set: cmd.Flags().Changed("gpu"), Value: gpuVal},
 		Memory:              memory,
+		VideoMemory:         videoMemory,
 		InvocationID:        invocationID,
 		Kiosk:               BoolFlag{Set: cmd.Flags().Changed("kiosk"), Value: kioskVal},
 		ProfileID:           profileID,

cmd/browsers_test.go

@@ -900,6 +900,35 @@ func TestBrowsersCreate_WithMemory(t *testing.T) {
 	assert.Error(t, b.Create(context.Background(), BrowsersCreateInput{Memory: "4GiB"}))
 }
 
+func TestBrowsersCreate_WithVideoMemory(t *testing.T) {
+	setupStdoutCapture(t)
+
+	var captured kernel.BrowserNewParams
+	fake := &FakeBrowsersService{
+		NewFunc: func(ctx context.Context, body kernel.BrowserNewParams, opts ...option.RequestOption) (*kernel.BrowserNewResponse, error) {
+			captured = body
+			return &kernel.BrowserNewResponse{SessionID: "sess-video-memory"}, nil
+		},
+	}
+	b := BrowsersCmd{browsers: fake}
+
+	err := b.Create(context.Background(), BrowsersCreateInput{GPU: BoolFlag{Set: true, Value: true}, VideoMemory: "4gib"})
+	require.NoError(t, err)
+	assert.Equal(t, kernel.BrowserVideoMemory4GiB, captured.VideoMemory)
+
+	raw, err := captured.MarshalJSON()
+	require.NoError(t, err)
+	assert.Contains(t, string(raw), `"video_memory":"4GiB"`)
+
+	// Omitting the flag sends nothing; the server defaults to 2GiB.
+	err = b.Create(context.Background(), BrowsersCreateInput{GPU: BoolFlag{Set: true, Value: true}})
+	require.NoError(t, err)
+	assert.Empty(t, captured.VideoMemory)
+
+	// An unsupported size is rejected before the request is made.
+	assert.Error(t, b.Create(context.Background(), BrowsersCreateInput{VideoMemory: "8GiB"}))
+}
+
 func TestBrowsersCreate_WithChromePolicy(t *testing.T) {
 	setupStdoutCapture(t)
 

cmd/vaults.go

@@ -51,6 +51,14 @@ func (c VaultsCmd) Get(ctx context.Context, vault, output string) error {
 	return printVault(v, output)
 }
 
+func (c VaultsCmd) GetEncryptionKey(ctx context.Context, vault, output string) error {
+	k, err := c.vaults.GetEncryptionKey(ctx, vault, option.WithMaxRetries(0))
+	if err != nil {
+		return util.CleanedUpSdkError{Err: err}
+	}
+	return printVaultEncryptionKey(k, output)
+}
+
 func (c VaultsCmd) List(ctx context.Context, limit, offset int64, query, project, output string) error {
 	if limit < 1 || limit > 100 || offset < 0 {
 		return fmt.Errorf("--limit must be between 1 and 100; --offset must be non-negative")

cmd/vaults_commands.go

@@ -132,7 +132,23 @@ JSON output preserves returned public fields but omits unknown/opaque provider d
 			return getVaultsHandler(cmd).Get(cmd.Context(), args[0], vaultOutput(cmd))
 		}}
 	addVaultJSONOutputFlag(get)
-	cmd.AddCommand(create, list, get, newVaultDeleteCommand(false))
+
+	encryptionKey := &cobra.Command{Use: "get-encryption-key <vault>", Short: "Get a vault's public key for browser-encrypted credential values", Args: cobra.ExactArgs(1), PreRunE: vaultPreRun,
+		Long: `Get the public key that custom credential collection web apps use to encrypt values in the browser.
+
+Use this only if you run your own credential collection web app and want values
+encrypted in the browser, sent to your backend still encrypted, and forwarded to
+Kernel's API still encrypted. In every other case, including server-side code that
+already holds the plaintext, use value. The page encrypts each value to this key as a
+compact JWE (alg ECDH-ES, enc A256GCM, kid in the protected header), and your backend
+forwards the ciphertext unchanged as encrypted_value in credentials create/update specs.
+Each vault has its own key; it is created on first request and may be cached.`,
+		Example: "  kernel vaults get-encryption-key user-vault -o json",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return getVaultsHandler(cmd).GetEncryptionKey(cmd.Context(), args[0], vaultOutput(cmd))
+		}}
+	addJSONOutputFlag(encryptionKey)
+	cmd.AddCommand(create, list, get, encryptionKey, newVaultDeleteCommand(false))
 
 	items := &cobra.Command{Use: "items", Short: "Inspect readiness and collection URLs, or invoke collect/fill/webmcp_invoke", Long: "Use get --wait 60 to observe readiness and get -o json for schema/version/presence.\nUse invoke collect to obtain a collection URL, or invoke fill --spec-file to fill a browser.\nUse webmcp invoke to call a live WebMCP tool with item fields bound to null input slots.\n1Password credentials use the advertised 1pw_* operations instead of collect/fill/webmcp_invoke.\nCreate and edit credentials with vaults credentials; payment items use wallets/cards."}
 	itemList := &cobra.Command{Use: "list <vault>", Short: "List items by vault ID or name", Args: cobra.ExactArgs(1), PreRunE: vaultPreRun,

cmd/vaults_credentials.go

@@ -107,6 +107,8 @@ user-facing collection form renders that order unchanged. Definitions accept a s
 name and an optional non-secret human-readable label; forms fall back to name. Updates,
 state, and browser fills always use name. Field types are text, email, password, and
 totp; definitions also accept required, sensitive, and value.
+Custom collection web apps that encrypt in the browser may send encrypted_value (a
+compact JWE to the key from vaults get-encryption-key) instead of value; never both.
 Set description to the recognizable site name only, e.g. "Hacker News", not
 "Hacker News sign-in credentials". This text is the user-facing form title.
 Set sensitive:false explicitly for ordinary usernames and email addresses.
@@ -155,7 +157,7 @@ func newVaultCredentialsCommand() *cobra.Command {
 			},
 		}
 		if update {
-			cmd.Long += "\nUpdate applies to Kernel-hosted credentials only. Update spec fields are an object keyed by field name, not the ordered array used on create.\nUpdate preserves omitted fields, replaces nonempty string values, and clears supported values with null or an empty string. Clearing a required text/email/password field returns pending_collection; form submissions still require a nonempty value.\nField definitions are immutable. Do not automatically retry version conflicts."
+			cmd.Long += "\nUpdate applies to Kernel-hosted credentials only. Update spec fields are an object keyed by field name, not the ordered array used on create.\nUpdate preserves omitted fields, replaces nonempty string values (value, or encrypted_value from a browser-encrypting collection app), and clears supported values with null or an empty string. Clearing a required text/email/password field returns pending_collection; form submissions still require a nonempty value.\nField definitions are immutable. Do not automatically retry version conflicts."
 			cmd.Flags().Int64("version", 0, "Expected version from items get (required; never auto-refreshed)")
 			_ = cmd.MarkFlagRequired("version")
 			cmd.Flags().String("expected-item-id", "", "Immutable item ID from the original read; reject an update if the key now refers to a replacement item")

cmd/vaults_output.go

@@ -235,6 +235,18 @@ func printVault(v *kernel.Vault, output string) error {
 	return nil
 }
 
+// The encryption key is public, so JSON output passes the API response through unchanged.
+func printVaultEncryptionKey(k *kernel.VaultEncryptionKey, output string) error {
+	if output == "json" {
+		return printVaultJSON(json.RawMessage(k.RawJSON()))
+	}
+	PrintTableNoPad(pterm.TableData{
+		{"Property", "Value"}, {"Key ID (kid)", k.Kid}, {"Algorithm (alg)", string(k.Alg)}, {"Encryption (enc)", string(k.Enc)},
+		{"JWK kty", k.Jwk.Kty}, {"JWK crv", k.Jwk.Crv}, {"JWK x", k.Jwk.X}, {"JWK y", k.Jwk.Y},
+	}, true)
+	return nil
+}
+
 func vaultDisplayURL(address string) bool {
 	u, err := url.Parse(address)
 	if err != nil || (u.Scheme != "https" && u.Scheme != "http") || u.Hostname() == "" || u.User != nil {

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.121.1-0.20261009121157-454206ab83bc
+	github.com/kernel/kernel-go-sdk v0.122.1-0.20261009181557-f737b63ffd16
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80

go.sum

@@ -66,8 +66,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.121.1-0.20261009121157-454206ab83bc h1:iIVpTV5HZMbbDp74IB/0z1Qjz9uzL9wpKJRZXoiqPEk=
-github.com/kernel/kernel-go-sdk v0.121.1-0.20261009121157-454206ab83bc/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.122.1-0.20261009181557-f737b63ffd16 h1:/cyzSOIuZRlBmYJyXFBE0A62g+BZ+R+UNxA7VmZOJqE=
+github.com/kernel/kernel-go-sdk v0.122.1-0.20261009181557-f737b63ffd16/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=