[tnsardesai]

Summary

Adds --timezone and --locale to kernel browsers create and kernel browsers update, plus --clear-timezone and --clear-locale to update, so a session's timezone and locale can be set from the CLI. Bumps kernel-go-sdk from v0.126.0 to v0.129.0, which adds the location request and response fields.

• create: --timezone Europe/Berlin --locale de-DE sets either override. An omitted flag uses the browser region's default.
• update: --timezone/--locale set an override. --clear-timezone/--clear-locale send null, which clears it so the browser goes back to its region's default, like --clear-name and the other clear flags. An empty value is rejected with a pointer to the clear flag, and set plus clear is an error. An omitted flag leaves the field unchanged. Any one of the four counts as an update.
• output: create, get, and update show the effective timezone and locale with their source, e.g. Europe/Berlin (override) or America/New_York (default). -o json already returned location.

The flags aren't added to pool acquire (browsers create --pool-id), which doesn't accept a location; passing them there gets the existing "flags will be ignored" warning.

Validation

• make test (go vet ./..., go test ./...). New tests cover the create and update params, null for the clear flags, the empty-value and set-plus-clear errors (without calling the API), omitted flags not being sent, --clear-timezone --locale de-DE reaching the API through the cobra command, and the table output.
• golangci-lint run ./cmd/: no new findings.
• Ran the built binary against production on an organization with location enabled: create with --timezone Europe/Berlin --locale de-DE, then update --clear-timezone --locale ja-JP (timezone back to America/New_York (default), locale ja-JP (override)), then update --clear-locale (both defaults). update --timezone="" and update --locale de-DE --clear-locale were rejected locally. get showed the same values. The browser was deleted afterwards.

---

Note

Low Risk
CLI and SDK wiring for an existing browser location API; no auth or infrastructure changes, with solid test coverage.

Overview
Adds CLI support for browser session timezone (IANA) and locale (BCP 47) via new flags on kernel browsers create and kernel browsers update, with --clear-timezone / --clear-locale on update to reset overrides to the region default.

Create sends optional location fields on the API; update sets values or sends null to clear, with the usual validation (non-empty set values, no mixing set and clear). create, get, and update table output now shows effective timezone/locale and whether each comes from an override or the region default.

Bumps kernel-go-sdk from v0.126.0 to v0.129.0 for the location request/response types. README and tests cover flag wiring, PATCH payloads, errors, and display. Pool acquire (create --pool-id) does not accept location; those flags still trigger the existing “ignored with pool” behavior.

^{Reviewed by Cursor Bugbot for commit de106a4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.126.0 ⏵ v0.129.0	+1

View full report

[tnsardesai]

Picked bmsaadat to review: touched the changed code in cmd, lighter queue than rgarcia; nothing pending

[bmsaadat]

Approve. Set / clear-to-null / omit semantics match --clear-name and --clear-allowed-hosts, and the tests check real request bodies. A few non-blocking notes:

• Heads-up on #296: the coverage bot PR adds the same flags on the same SDK version, so it will conflict once this lands (duplicate formatBrowserLocationField and duplicate --timezone/--locale registrations on browsers create). CI will catch it, and the bot handled the same thing in #278, so just flagging it.
• Pooled browsers (follow-up idea): since a reuse release keeps the override, an acquired browser can carry the previous lease's location. It might be worth showing the location rows on browsers create --pool-* and browser-pools acquire at some point, and maybe a line in the update help like the --allowed-host one about pool release.
• Nit: cmd/browsers.go:3020, "omit them to leave a field unchanged" reads as if it means the clear flags; maybe "omit a flag to leave that field unchanged".