Update Go SDK to v0.141.0 and CLI coverage

Author: kernel-internal[bot]

cmd/browsers.go

@@ -203,13 +203,14 @@ func parseMemoryFlag(memory string) (kernel.BrowserMemoryRequest, error) {
 }
 
 // availableVideoMemorySizes returns the video memory (VRAM) sizes the API
-// accepts for a GPU browser session.
+// accepts for a GPU browser session. 2GiB and 4GiB are deprecated create-time
+// aliases for 3GiB and 6GiB.
 func availableVideoMemorySizes() []string {
-	return []string{"2GiB", "4GiB"}
+	return []string{"3GiB", "6GiB", "2GiB", "4GiB"}
 }
 
 // parseVideoMemoryFlag validates a --video-memory value. An empty value means the
-// flag was not set, which lets the API apply its default (2GiB).
+// flag was not set, which lets the API apply its default (3GiB).
 func parseVideoMemoryFlag(videoMemory string) (kernel.BrowserVideoMemory, error) {
 	if videoMemory == "" {
 		return "", nil
@@ -3560,7 +3561,7 @@ unrestricted code execution inside the browser VM and is not sandboxed.`,
 	browsersCreateCmd.Flags().BoolP("headless", "H", false, "Launch browser without GUI access")
 	browsersCreateCmd.Flags().Bool("gpu", false, "Launch browser with hardware-accelerated GPU rendering")
 	browsersCreateCmd.Flags().String("memory", "", "Memory for a non-GPU browser session. Headless: '1GiB' (default), '2GiB' or '4GiB'. Headful: '8GiB' (default) or '16GiB'")
-	browsersCreateCmd.Flags().String("video-memory", "", "Video memory (VRAM) for a GPU browser session (requires --gpu): '2GiB' (default, 4 vCPU/6GiB memory) or '4GiB' (8 vCPU/12GiB memory)")
+	browsersCreateCmd.Flags().String("video-memory", "", "Video memory (VRAM) for a GPU browser session (requires --gpu): '3GiB' (default, 4 vCPU/6GiB memory) or '6GiB' (8 vCPU/12GiB memory). Deprecated create-only aliases '2GiB' and '4GiB' are accepted, but responses use 3GiB or 6GiB")
 	browsersCreateCmd.Flags().String("fingerprint-os", "", "Closed beta browser fingerprint OS override: macos. Contact Kernel to enable; requires --stealth=true, --headless=false, --gpu=false, and default memory")
 	browsersCreateCmd.Flags().String("invocation-id", "", "Associate the browser session with an invocation")
 	browsersCreateCmd.Flags().Bool("kiosk", false, "Launch browser in kiosk mode")

cmd/browsers_test.go

@@ -1036,6 +1036,15 @@ func TestBrowsersCreate_WithMemory(t *testing.T) {
 	assert.Error(t, b.Create(context.Background(), BrowsersCreateInput{Memory: "3GiB"}))
 }
 
+func TestBrowsersVideoMemoryHelpMatchesCurrentSpec(t *testing.T) {
+	usage := browsersCreateCmd.Flags().Lookup("video-memory").Usage
+	for _, value := range []string{"3GiB", "6GiB", "2GiB", "4GiB"} {
+		assert.Contains(t, usage, value)
+	}
+	assert.Contains(t, usage, "Deprecated create-only aliases")
+	assert.Contains(t, usage, "responses use 3GiB or 6GiB")
+}
+
 func TestBrowsersCreate_WithVideoMemory(t *testing.T) {
 	setupStdoutCapture(t)
 
@@ -1048,15 +1057,25 @@ func TestBrowsersCreate_WithVideoMemory(t *testing.T) {
 	}
 	b := BrowsersCmd{browsers: fake}
 
-	err := b.Create(context.Background(), BrowsersCreateInput{GPU: BoolFlag{Set: true, Value: true}, VideoMemory: "4gib"})
+	err := b.Create(context.Background(), BrowsersCreateInput{GPU: BoolFlag{Set: true, Value: true}, VideoMemory: "6gib"})
 	require.NoError(t, err)
-	assert.Equal(t, kernel.BrowserVideoMemory4GiB, captured.VideoMemory)
+	assert.Equal(t, kernel.BrowserVideoMemory6GiB, captured.VideoMemory)
 
 	raw, err := captured.MarshalJSON()
 	require.NoError(t, err)
-	assert.Contains(t, string(raw), `"video_memory":"4GiB"`)
+	assert.Contains(t, string(raw), `"video_memory":"6GiB"`)
+
+	// The lower canonical size is accepted too.
+	err = b.Create(context.Background(), BrowsersCreateInput{GPU: BoolFlag{Set: true, Value: true}, VideoMemory: "3GiB"})
+	require.NoError(t, err)
+	assert.Equal(t, kernel.BrowserVideoMemory3GiB, captured.VideoMemory)
+
+	// Deprecated aliases remain accepted on create; the API canonicalizes responses.
+	err = b.Create(context.Background(), BrowsersCreateInput{GPU: BoolFlag{Set: true, Value: true}, VideoMemory: "4gib"})
+	require.NoError(t, err)
+	assert.Equal(t, kernel.BrowserVideoMemory4GiB, captured.VideoMemory)
 
-	// Omitting the flag sends nothing; the server defaults to 2GiB.
+	// Omitting the flag sends nothing; the server defaults to 3GiB.
 	err = b.Create(context.Background(), BrowsersCreateInput{GPU: BoolFlag{Set: true, Value: true}})
 	require.NoError(t, err)
 	assert.Empty(t, captured.VideoMemory)

cmd/search.go

@@ -17,6 +17,8 @@ import (
 	"github.com/spf13/pflag"
 )
 
+var searchProviderSlugs = []string{"brave", "exa", "perplexity", "context", "parallel", "octen", "you", "tavily"}
+
 func newSearchCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "search [query]",
@@ -29,7 +31,7 @@ func newSearchCommand() *cobra.Command {
 		RunE:    runSearch,
 	}
 	cmd.PersistentFlags().StringP("output", "o", "", util.JSONOutputFlagDescription)
-	cmd.Flags().String("provider", "", "Pin a provider slug (default: automatic routing)")
+	cmd.Flags().String("provider", "", "Pin a provider slug: brave, exa, perplexity, context, parallel, octen, you, or tavily (default: automatic routing)")
 	cmd.Flags().Int("max-results", 10, "Requested result count (1–100; subject to provider cap)")
 	cmd.Flags().String("request", "", "Complete Search API request as a JSON object; cannot be combined with query flags")
 	cmd.MarkFlagsMutuallyExclusive("request", "provider")
@@ -48,7 +50,7 @@ func newSearchCommand() *cobra.Command {
 		}
 		return executeSearchRequest(cmd, http.MethodGet, path, nil)
 	}}
-	providers.Flags().String("slug", "", "Filter by provider slug")
+	providers.Flags().String("slug", "", "Filter by provider slug: brave, exa, perplexity, context, parallel, octen, you, or tavily")
 	contents := &cobra.Command{
 		Use:   "contents <id>",
 		Short: "Fetch content for selected results of a retained search as JSON",
@@ -213,8 +215,9 @@ func runSearch(cmd *cobra.Command, args []string) error {
 		}
 		if cmd.Flags().Changed("provider") {
 			provider, _ := cmd.Flags().GetString("provider")
-			if strings.TrimSpace(provider) == "" {
-				return fmt.Errorf("--provider must not be empty")
+			provider = strings.ToLower(strings.TrimSpace(provider))
+			if !slices.Contains(searchProviderSlugs, provider) {
+				return fmt.Errorf("--provider must be one of: %s", strings.Join(searchProviderSlugs, ", "))
 			}
 			request["strategy"] = map[string]any{"type": "pinned", "provider": map[string]string{"provider": provider}}
 		}

cmd/search_test.go

@@ -40,7 +40,7 @@ func TestSearchCreate(t *testing.T) {
 		stdin, want string
 	}{
 		{"auto", []string{"test"}, "", `{"query":"test"}`},
-		{"pinned", []string{"test", "--provider", "exa", "--max-results", "5"}, "", `{"query":"test","max_results":5,"strategy":{"type":"pinned","provider":{"provider":"exa"}}}`},
+		{"pinned", []string{"test", "--provider", "EXA", "--max-results", "5"}, "", `{"query":"test","max_results":5,"strategy":{"type":"pinned","provider":{"provider":"exa"}}}`},
 		{"advanced request", []string{"--request", advanced}, "", advanced},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -132,6 +132,7 @@ func TestSearchContents(t *testing.T) {
 func TestSearchInvalidInput(t *testing.T) {
 	for _, args := range [][]string{
 		{}, {" "}, {strings.Repeat("x", 2049)}, {"a", "b"}, {"test", "--provider", ""},
+		{"test", "--provider", "valyu"}, {"test", "--provider", "serpapi"}, {"test", "--provider", "unknown"},
 		{"test", "--max-results", "0"}, {"test", "--max-results", "101"},
 		{"test", "-o", "yaml"}, {"get", "srch_test", "-o", "yaml"}, {"contents", "srch_test", "--limit", "1", "-o", "yaml"},
 		{"--request", "null"}, {"--request", "[]"}, {"--request", "{"}, {"--request", `{}`}, {"--request", `{"query":1}`},
@@ -176,6 +177,16 @@ func TestSearchErrorsDoNotRetryCreate(t *testing.T) {
 	}
 }
 
+func TestSearchProviderHelpMatchesCurrentSpec(t *testing.T) {
+	cmd := newSearchCommand()
+	usage := cmd.Flags().Lookup("provider").Usage
+	for _, provider := range searchProviderSlugs {
+		assert.Contains(t, usage, provider)
+	}
+	assert.NotContains(t, usage, "valyu")
+	assert.NotContains(t, usage, "serpapi")
+}
+
 func TestSearchWiring(t *testing.T) {
 	for _, path := range [][]string{{"search"}, {"search", "get"}, {"search", "providers"}, {"search", "contents"}} {
 		cmd, remaining, err := rootCmd.Find(path)

cmd/vault_provider_configs.go

@@ -14,7 +14,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var vaultProviderConfigFields = vaultFieldsOf("id name provider client_id publishable_key test_mode created_at updated_at")
+var vaultProviderConfigFields = vaultFieldsOf("id name provider client_id publishable_key test_mode vault_id environment created_at updated_at")
 
 type VaultProviderConfigsCmd struct {
 	configs  *kernel.VaultProviderConfigService
@@ -33,11 +33,12 @@ func getVaultProviderConfigsHandler(cmd *cobra.Command) VaultProviderConfigsCmd
 func newVaultProviderConfigsCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use: "vault-provider-configs", Short: "Manage organization-owned vault provider configurations",
-		Long: `Manage Link OAuth clients and AgentCard application credentials, shared across projects.
+		Long: `Manage Link OAuth clients, AgentCard application credentials, and VGS service accounts shared across projects.
 Config credentials are not wallet grants. Link grants are imported separately when creating a wallet.
+VGS configurations identify one customer-managed vault and environment for alias reveal.
 Writes require organization-scoped authentication; --project does not elevate a project API key.
-Provider and client ID are immutable. Rename or rotate a secret without changing wallet bindings.
-Rotation affects all bound wallets and must preserve client identity and AgentCard mode.
+Provider and client ID are immutable. VGS vault ID and environment are immutable too.
+Rename or rotate a secret without changing wallet bindings; rotation revalidates the same provider identity and mode.
 Secrets are accepted only from a file or stdin and are never displayed. Protect credential files.`,
 	}
 	preRun := func(cmd *cobra.Command, args []string) error {
@@ -49,34 +50,44 @@ Secrets are accepted only from a file or stdin and are never displayed. Protect
 		}
 		return nil
 	}
-	create := &cobra.Command{Use: "create --name <name> --provider <link|agentcard> --credentials-file <path|->", Short: "Register a provider configuration", Args: cobra.NoArgs, PreRunE: preRun,
-		Long: "Register a configuration; duplicate names return a conflict without replacing credentials.\n--credentials-file must contain a JSON object with client_id and client_secret strings.\nUse a protected file or pipe from a secret manager; never put credentials in shell arguments.\nFor Link, pass --publishable-key so imported wallet grants keep working after their access token expires.",
+	create := &cobra.Command{Use: "create --name <name> --provider <link|agentcard|vgs> --credentials-file <path|->", Short: "Register a provider configuration", Args: cobra.NoArgs, PreRunE: preRun,
+		Long: "Register a configuration; duplicate names return a conflict without replacing credentials.\n--credentials-file must contain client_id and client_secret strings. For VGS it must also contain vault_id and environment (sandbox or live); the service account needs aliases:read access to that vault. Kernel validates the VGS scope and vault access before storing anything.\nUse a protected file or pipe from a secret manager; never put credentials in shell arguments.\nFor Link, pass --publishable-key so imported wallet grants keep working after their access token expires.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			name, _ := cmd.Flags().GetString("name")
 			if err := validateVaultName(name, "--name"); err != nil {
 				return err
 			}
 			provider, _ := cmd.Flags().GetString("provider")
-			if provider != "link" && provider != "agentcard" {
-				return fmt.Errorf("--provider must be link or agentcard")
+			if provider != "link" && provider != "agentcard" && provider != "vgs" {
+				return fmt.Errorf("--provider must be link, agentcard, or vgs")
 			}
 			publishableKey, _ := cmd.Flags().GetString("publishable-key")
 			if cmd.Flags().Changed("publishable-key") && (provider != "link" || publishableKey == "") {
 				return fmt.Errorf("--publishable-key requires --provider link and a non-empty value")
 			}
-			credentials, err := readVaultSecrets(cmd, "credentials-file", "client_id", "client_secret")
+			credentialFields := []string{"client_id", "client_secret"}
+			if provider == "vgs" {
+				credentialFields = append(credentialFields, "vault_id", "environment")
+			}
+			credentials, err := readVaultSecrets(cmd, "credentials-file", credentialFields...)
 			if err != nil {
 				return err
 			}
 			params := kernel.VaultProviderConfigNewParams{}
-			if provider == "link" {
+			switch provider {
+			case "link":
 				linkCredentials := kernel.VaultProviderConfigNewParamsBodyLinkCredentials{ClientID: credentials["client_id"], ClientSecret: credentials["client_secret"]}
 				if publishableKey != "" {
 					linkCredentials.PublishableKey = kernel.Opt(publishableKey)
 				}
 				params.OfLink = &kernel.VaultProviderConfigNewParamsBodyLink{Name: name, Credentials: linkCredentials}
-			} else {
+			case "agentcard":
 				params.OfAgentcard = &kernel.VaultProviderConfigNewParamsBodyAgentcard{Name: name, Credentials: kernel.VaultProviderConfigNewParamsBodyAgentcardCredentials{ClientID: credentials["client_id"], ClientSecret: credentials["client_secret"]}}
+			case "vgs":
+				params.OfVgs = &kernel.VaultProviderConfigNewParamsBodyVgs{Name: name, Credentials: kernel.VaultProviderConfigNewParamsBodyVgsCredentials{
+					ClientID: credentials["client_id"], ClientSecret: credentials["client_secret"],
+					VaultID: credentials["vault_id"], Environment: credentials["environment"],
+				}}
 			}
 			c := getVaultProviderConfigsHandler(cmd)
 			config, err := c.configs.New(cmd.Context(), params, vaultWriteRequestOptions()...)
@@ -86,8 +97,8 @@ Secrets are accepted only from a file or stdin and are never displayed. Protect
 			return printVaultProviderConfig(config, vaultOutput(cmd))
 		}}
 	create.Flags().String("name", "", "Organization-unique configuration name (required)")
-	create.Flags().String("provider", "", "Provider: link or agentcard (required)")
-	create.Flags().String("credentials-file", "", "Read client_id and client_secret JSON from a file (use '-' for stdin)")
+	create.Flags().String("provider", "", "Provider: link, agentcard, or vgs (required)")
+	create.Flags().String("credentials-file", "", "Read provider credential JSON from a file (use '-' for stdin); VGS also requires vault_id and environment")
 	create.Flags().String("publishable-key", "", "Link only. Stripe publishable key for the account that owns the Link OAuth client; required for Kernel to refresh or revoke imported wallet grants")
 	for _, flag := range []string{"name", "provider", "credentials-file"} {
 		_ = create.MarkFlagRequired(flag)
@@ -116,7 +127,7 @@ Secrets are accepted only from a file or stdin and are never displayed. Protect
 	addVaultJSONOutputFlag(list)
 
 	update := &cobra.Command{Use: "update <id-or-name>", Short: "Rename a configuration or rotate its secret", Args: cobra.ExactArgs(1), PreRunE: preRun,
-		Long: "Omitted fields remain unchanged. --credentials-file accepts only a client_secret JSON string field.\n--publishable-key sets the Stripe publishable key on Link configurations.\nProvider, client ID, and mode cannot change. Rotation affects all wallets using this configuration.",
+		Long: "Omitted fields remain unchanged. --credentials-file accepts only a client_secret JSON string field.\n--publishable-key sets the Stripe publishable key on Link configurations.\nProvider and client ID cannot change. AgentCard mode is preserved. VGS vault_id and environment are immutable; rotating its secret repeats the aliases:read and vault-access checks against the same vault and environment. Rotation affects all wallets using this configuration.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if !cmd.Flags().Changed("name") && !cmd.Flags().Changed("credentials-file") && !cmd.Flags().Changed("publishable-key") {
 				return fmt.Errorf("provide --name, --credentials-file, or --publishable-key")
@@ -208,13 +219,13 @@ func (c VaultProviderConfigsCmd) List(ctx context.Context, limit, offset int64,
 	if len(page.Items) == 0 {
 		pterm.Info.Println("No vault provider configurations found")
 	} else {
-		rows := pterm.TableData{{"ID", "Name", "Provider", "Client ID", "Test mode"}}
+		rows := pterm.TableData{{"ID", "Name", "Provider", "Client ID", "Vault ID", "Environment", "Test mode"}}
 		for _, config := range page.Items {
 			mode := "—"
 			if config.JSON.TestMode.Valid() {
 				mode = fmt.Sprint(config.TestMode)
 			}
-			rows = append(rows, []string{config.ID, config.Name, config.Provider, config.ClientID, mode})
+			rows = append(rows, []string{config.ID, config.Name, config.Provider, config.ClientID, util.OrDash(config.VaultID), util.OrDash(config.Environment), mode})
 		}
 		PrintTableNoPad(rows, true)
 	}
@@ -239,6 +250,12 @@ func printVaultProviderConfig(config *kernel.VaultProviderConfigUnion, output st
 	if config.JSON.TestMode.Valid() {
 		rows = append(rows, []string{"Test mode (introspected)", fmt.Sprint(config.TestMode)})
 	}
+	if config.JSON.VaultID.Valid() {
+		rows = append(rows, []string{"VGS vault ID (immutable)", config.VaultID})
+	}
+	if config.JSON.Environment.Valid() {
+		rows = append(rows, []string{"VGS environment (immutable)", config.Environment})
+	}
 	rows = append(rows, []string{"Created At", util.FormatLocal(config.CreatedAt)}, []string{"Updated At", util.FormatLocal(config.UpdatedAt)})
 	PrintTableNoPad(rows, true)
 	return nil