Add browser proxy routes to CLI create

[hiroTamada]

Summary

• Add repeatable, create-only --proxy-route with typed SDK request construction and light syntax/count validation.
• Display returned proxy routes alongside private hosts in create/get output, including SDK-backed JSON output.
• Upgrade kernel-go-sdk to v0.112.0 and adapt WebMCP list handling to its updated SDK types.

Validation

• go test ./... and make test passed.
• make build passed; gofmt and git diff --check clean.
• make lint ran with 70 existing repo-wide findings (50 errcheck, 3 ineffassign, 16 staticcheck, 1 unused); none on changed lines.
• No live API smoke test performed.

---

Note

Medium Risk
Changes browser session egress configuration at creation time and upgrades the SDK; incorrect routes could misroute traffic, though host matching is API-validated and routes are create-only.

Overview
Adds create-only --proxy-route to kernel browsers create, mapping HOST[,HOST...]=PROXY (proxy ID by default, or id: / name:) into the browser network config with client-side limits (10 routes, 50 hosts per route) and rejection when combined with pool acquire flags.

Network request shaping now omits empty private_hosts and only sends network when private hosts or proxy routes are present; create/get table output adds a Proxy Routes row alongside private hosts.

Bumps kernel-go-sdk to v0.112.0 and updates WebMCP list for the new tool payload shape (tool.name, readOnlyHint) and ListTools params. README documents the new flag.

^{Reviewed by Cursor Bugbot for commit 72f0623. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.110.0 ⏵ v0.112.0	+1

View full report

[chruffins]

reviewed — looks good, limits match the API validator (10 routes, 1–50 hosts, exactly one of id/name). a few things worth a look:

Questions

• go.mod:12 — the v0.112.0 bump also changes the webmcp list response format (tools[].name → tools[].tool.name, read_only → readOnlyHint). is that API change already deployed to prod? if the CLI ships first, browsers webmcp list shows empty tool names and read-only flags
• cmd/browsers.go:3248 / README.md:258 — the API spec says setting routes requires proxy v3. might be worth mentioning so users aren't surprised by the API error

Nits

• cmd/browsers_webmcp.go:42-60 — browsers webmcp list -o json output changes format with the SDK bump, which breaks scripts reading the old fields. consider a line in the release notes
• cmd/browsers.go:3248 — nit: flag help says start_url; the README says --start-url
• cmd/browsers.go:251 — nit: rejecting any = in the selector means a proxy with = in its name can't be selected with name:. probably fine, just flagging