Route computer and playwright calls directly to the VM

[tnsardesai]

Summary

Default direct-to-VM routing now includes computer and playwright in addition to curl and telemetry/stream.

computer/screenshot and playwright/execute rewrite to {base_url}/... with the session JWT and drop Authorization. process/*, fs/*, and telemetry/events stay on the API origin.

KERNEL_BROWSER_ROUTING_SUBRESOURCES still overrides the default list. An empty value still disables routing.

Metro-api activity recording for /browser/kernel/* has been merged in kernel/kernel#3417. That was the hard gate for this allowlist flip. The kill switch is leaving base_url unset or setting KERNEL_BROWSER_ROUTING_SUBRESOURCES to empty.

Latency (eu-west)

Same hop skip as the Node/Python SDKs. Comparison script: https://gist.github.com/tnsardesai/6704dfc86e2c0785e03beaf274aa672d

Same eu-west session. Published SDK still hits api.onkernel.com; this allowlist rewrite hits metro-api.

creating eu-west browser…
session rao32cls5rhduxg9n1a732i5
region eu-west
base_url https://proxy.dub-unruffled-kowalevski.onkernel.com:8443/browser/kernel
cdp host proxy.dub-unruffled-kowalevski.onkernel.com:8443
rounds warmup=2 timed=8
control plane (@onkernel/sdk@0.93.0)
control-plane screenshot 498ms api.onkernel.com
control-plane screenshot 884ms api.onkernel.com
control-plane screenshot 647ms api.onkernel.com
control-plane screenshot 508ms api.onkernel.com
control-plane screenshot 614ms api.onkernel.com
control-plane screenshot 512ms api.onkernel.com
control-plane screenshot 509ms api.onkernel.com
control-plane screenshot 408ms api.onkernel.com
control-plane screenshot 622ms api.onkernel.com
control-plane screenshot 590ms api.onkernel.com
min 410ms p50 513ms p95 650ms max 650ms
direct to VM (kernel-node-sdk#hypeship/tier1-direct-allowlist)
direct-to-vm screenshot 648ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 623ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 321ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 335ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 332ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 329ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 345ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 344ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 339ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
direct-to-vm screenshot 341ms proxy.dub-unruffled-kowalevski.onkernel.com:8443
min 324ms p50 337ms p95 347ms max 347ms
p50 delta control-plane 513ms vs direct 337ms (-176ms)

Test plan

• default allowlist includes curl, telemetry/stream, computer, playwright
• computer screenshot and playwright execute rewrite to the VM and drop Authorization
• process, fs, and telemetry/events stay on the API origin

---

Note

Medium Risk
Changes where computer/playwright traffic is sent and how it is authenticated (JWT vs API key). Env override remains a kill switch.

Overview
Expands the default direct-to-VM allowlist so computer and playwright requests skip the control plane, same as curl and telemetry/stream.

Those calls rewrite to the session base_url with the session JWT and drop Authorization. process, fs, and telemetry/events still hit the API. KERNEL_BROWSER_ROUTING_SUBRESOURCES still overrides the list; empty still disables routing.

^{Reviewed by Cursor Bugbot for commit 7f8a78d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rgarcia]

QA’d commit 2e664a9 with unit, race, server-side, and live testing.

• go test ./... and go test -race ./... passed.
• Three live browser sessions confirmed direct routing for screenshot, mouse position, batch, and Playwright execution.
• Request traces showed {base_url}/browser/kernel/... with the session JWT and no Authorization.
• Process, filesystem, and telemetry-events calls remained on the API origin with authorization intact.
• Empty and computer-only env overrides behaved correctly.
• 16 concurrent computer/Playwright operations completed without failure.
• All test sessions were deleted afterward.

The server exposes the full computer/* surface and playwright/execute, and the metro proxy handles the complete /browser/kernel/* path. The only nit is that the PR description understates the scope by naming screenshot rather than the whole computer prefix.

No blocking findings.