Route computer and playwright calls directly to the VM

[tnsardesai]

Summary

Default direct-to-VM routing now includes computer and playwright in addition to curl and telemetry/stream.

computer/screenshot and playwright/execute rewrite to {base_url}/... with the session JWT and drop Authorization. process/*, fs/*, and telemetry/events stay on the API origin.

KERNEL_BROWSER_ROUTING_SUBRESOURCES still overrides the default list. An empty value still disables routing.

Metro-api activity recording for /browser/kernel/* has been merged in kernel/kernel#3417. That was the hard gate for this allowlist flip. The kill switch is leaving base_url unset or setting KERNEL_BROWSER_ROUTING_SUBRESOURCES to empty.

Latency (eu-west)

Same hop skip as the Node/Python SDKs. Comparison script: https://gist.github.com/tnsardesai/6704dfc86e2c0785e03beaf274aa672d

Same eu-west session. Published SDK still hits api.onkernel.com; this allowlist rewrite hits metro-api.

creating eu-west browser…
session  rao32cls5rhduxg9n1a732i5
region   eu-west
base_url https://proxy.dub-unruffled-kowalevski.onkernel.com:8443/browser/kernel
cdp host proxy.dub-unruffled-kowalevski.onkernel.com:8443
rounds   warmup=2 timed=8

control plane (@onkernel/sdk@0.93.0)
    control-plane screenshot    498ms  api.onkernel.com
    control-plane screenshot    884ms  api.onkernel.com
    control-plane screenshot    647ms  api.onkernel.com
    control-plane screenshot    508ms  api.onkernel.com
    control-plane screenshot    614ms  api.onkernel.com
    control-plane screenshot    512ms  api.onkernel.com
    control-plane screenshot    509ms  api.onkernel.com
    control-plane screenshot    408ms  api.onkernel.com
    control-plane screenshot    622ms  api.onkernel.com
    control-plane screenshot    590ms  api.onkernel.com
  min 410ms  p50 513ms  p95 650ms  max 650ms

direct to VM (kernel-node-sdk#hypeship/tier1-direct-allowlist)
    direct-to-vm  screenshot    648ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    623ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    321ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    335ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    332ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    329ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    345ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    344ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    339ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
    direct-to-vm  screenshot    341ms  proxy.dub-unruffled-kowalevski.onkernel.com:8443
  min 324ms  p50 337ms  p95 347ms  max 347ms

p50 delta  control-plane 513ms  vs  direct 337ms  (-176ms)

Test plan

• default allowlist includes curl, telemetry/stream, computer, playwright
• computer screenshot and playwright execute rewrite to the VM and drop Authorization
• process, fs, and telemetry/events stay on the API origin

---

Note

Medium Risk
Changes where computer/playwright traffic is sent and how it is authenticated (JWT vs API key). Env override remains a kill switch.

Overview
Expands the default direct-to-VM allowlist so computer and playwright requests skip the control plane, same as curl and telemetry/stream.

Those calls rewrite to the session base_url with the session JWT and drop Authorization. process, fs, and telemetry/events still hit the API. KERNEL_BROWSER_ROUTING_SUBRESOURCES still overrides the list; empty still disables routing.

^{Reviewed by Cursor Bugbot for commit 7f8a78d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rgarcia]

QA’d commit 2e664a9 with unit, race, server-side, and live testing.

• go test ./... and go test -race ./... passed.
• Three live browser sessions confirmed direct routing for screenshot, mouse position, batch, and Playwright execution.
• Request traces showed {base_url}/browser/kernel/... with the session JWT and no Authorization.
• Process, filesystem, and telemetry-events calls remained on the API origin with authorization intact.
• Empty and computer-only env overrides behaved correctly.
• 16 concurrent computer/Playwright operations completed without failure.
• All test sessions were deleted afterward.

The server exposes the full computer/* surface and playwright/execute, and the metro proxy handles the complete /browser/kernel/* path. The only nit is that the PR description understates the scope by naming screenshot rather than the whole computer prefix.

No blocking findings.