feat: add browser-scoped session client

[rgarcia]

Summary

• add kernel.for_browser(...) and async_kernel.for_browser(...) to create browser-scoped clients from browser session responses
• route browser subresource methods through the session base_url so callers stop repeating the browser id
• expose raw HTTP through browser.request(...) and browser.stream(...) while keeping the internal /curl/raw transport path hidden
• add focused tests for metro routing, JWT extraction, and browser-scoped raw HTTP behavior

Test plan

• uv run python -m pytest tests/test_browser_scoped.py -o addopts= -q

Made with Cursor

---

Note

Medium Risk
Adds a new client surface (Kernel.for_browser) that rewrites request routing to per-session base_url and injects JWT/query params, which could impact request correctness and auth if mis-generated or mis-parsed.

Overview
Adds Kernel.for_browser(...) / AsyncKernel.for_browser(...) to create a browser-scoped client that calls browser session subresources (e.g. process, fs, computer, etc.) without requiring an explicit id, by injecting the session id and routing requests via the session’s base_url.

Introduces kernel.lib.browser_scoped with a session-local HTTP client that strips the /browsers/{id} prefix, plus request()/stream() helpers that proxy arbitrary HTTP via the internal /curl/raw endpoint while preventing user params from overriding reserved jwt/url query keys.

Adds an AST-based generator (scripts/generate_browser_scoped.py) and committed generated_bindings.py for the bound resources, wires generation into scripts/lint, updates browser response docstrings for base_url, and adds targeted tests for routing, JWT extraction, and reserved-param behavior.

^{Reviewed by Cursor Bugbot for commit 8f1d506. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR adds browser-scoped session client functionality but does not appear to modify API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal) as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue. You can view the agent here.}

^{Reviewed by Cursor Bugbot for commit cfa07c9. Configure here.}