Use multi-method audit log search exclusions

[yummybomb]

Summary

• Updates the Go SDK dependency to v0.78.0 with list-typed audit-log exclusions.
• Sends the default GET exclusion and an explicit --exclude-method together through the API.
• Removes client-side exclusion filtering and its pagination workaround.

Dependency

Requires the server-side multi-exclusion support from kernel/kernel#2706, which is merged.

Example

$ kernel audit-logs search --limit 10
Timestamp               | Method | Status | Path                                                    | User             | Duration (ms) | Client IP
2026-07-13 19:00:54 UTC | POST   | 200    | /browser/kernel/configure                               | <redacted-email> | 8755          | <redacted-ip>
2026-07-13 19:00:53 UTC | POST   | 200    | /browsers/<browser-id>/playwright/execute               | <redacted-email> | 2223          | <redacted-ip>
2026-07-13 19:00:53 UTC | POST   | 200    | /browser/kernel/playwright/execute                      | <redacted-email> | 2038          | <redacted-ip>
2026-07-13 19:00:51 UTC | DELETE | 204    | /browsers/<browser-id>                                  | <redacted-email> | 22            | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browsers/<browser-id>/playwright/execute               | <redacted-email> | 3580          | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/playwright/execute                      | <redacted-email> | 3471          | <redacted-ip>
2026-07-13 19:00:51 UTC | PUT    | 201    | /browser/kernel/fs/write_file                           | <redacted-email> | 4             | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/process/exec                            | <redacted-email> | 7             | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/process/exec                            | <redacted-email> | 9246          | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/process/exec                            | <redacted-email> | 4752          | <redacted-ip>
INFO: Showing first 10 results; increase --limit or narrow the search window

GET requests are excluded by default. Pass --include-get to include them.

Test plan

• go test ./...
• go test -race ./cmd -run TestAuditLogsSearch
• go vet ./...
• Verify multiple exclusions serialize as exclude_method=GET,post
• Production smoke tests with limits 10 and 100
• Production smoke tests for default GET exclusion, --include-get, --method, and lowercase --exclude-method
• Production smoke tests for service, auth strategy, search, repeatable user ID, time window, table, and JSON output
• GitHub CI after the v0.78.0 update

[kernel-internal]

🔧 CI Fix Available

I've pushed a fix for the CI failure. The build failed with missing go.sum entry for github.com/kernel/kernel-go-sdk because go.mod pins v0.77.0 but go.sum still referenced v0.75.0. The fix regenerates go.sum so it matches the pinned v0.77.0 module version. make test (go vet + go test ./...) now passes.

👉 Click here to create a PR with the fix

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.75.0 ⏵ v0.78.0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6c7b697. Configure here.}