Use multi-method audit log search exclusions

[yummybomb]

Summary

• Updates the Go SDK dependency to v0.78.0 with list-typed audit-log exclusions.
• Sends the default GET exclusion and an explicit --exclude-method together through the API.
• Removes client-side exclusion filtering and its pagination workaround.

Dependency

Requires the server-side multi-exclusion support from kernel/kernel#2706, which is merged.

Example

$ kernel audit-logs search --limit 10
Timestamp               | Method | Status | Path                                                    | User             | Duration (ms) | Client IP
2026-07-13 19:00:54 UTC | POST   | 200    | /browser/kernel/configure                               | <redacted-email> | 8755          | <redacted-ip>
2026-07-13 19:00:53 UTC | POST   | 200    | /browsers/<browser-id>/playwright/execute               | <redacted-email> | 2223          | <redacted-ip>
2026-07-13 19:00:53 UTC | POST   | 200    | /browser/kernel/playwright/execute                      | <redacted-email> | 2038          | <redacted-ip>
2026-07-13 19:00:51 UTC | DELETE | 204    | /browsers/<browser-id>                                  | <redacted-email> | 22            | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browsers/<browser-id>/playwright/execute               | <redacted-email> | 3580          | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/playwright/execute                      | <redacted-email> | 3471          | <redacted-ip>
2026-07-13 19:00:51 UTC | PUT    | 201    | /browser/kernel/fs/write_file                           | <redacted-email> | 4             | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/process/exec                            | <redacted-email> | 7             | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/process/exec                            | <redacted-email> | 9246          | <redacted-ip>
2026-07-13 19:00:51 UTC | POST   | 200    | /browser/kernel/process/exec                            | <redacted-email> | 4752          | <redacted-ip>
INFO: Showing first 10 results; increase --limit or narrow the search window

GET requests are excluded by default. Pass --include-get to include them.

Test plan

• go test ./...
• go test -race ./cmd -run TestAuditLogsSearch
• go vet ./...
• Verify multiple exclusions serialize as exclude_method=GET,post
• Production smoke tests with limits 10 and 100
• Production smoke tests for default GET exclusion, --include-get, --method, and lowercase --exclude-method
• Production smoke tests for service, auth strategy, search, repeatable user ID, time window, table, and JSON output
• GitHub CI after the v0.78.0 update

[kernel-internal]

🔧 CI Fix Available

I've pushed a fix for the CI failure. The build failed with missing go.sum entry for github.com/kernel/kernel-go-sdk because go.mod pins v0.77.0 but go.sum still referenced v0.75.0. The fix regenerates go.sum so it matches the pinned v0.77.0 module version. make test (go vet + go test ./...) now passes.

👉 Click here to create a PR with the fix

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.75.0 ⏵ v0.78.0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6c7b697. Configure here.}

[firetiger-agent]

Created a monitoring plan for this PR.

What this PR does: Fixes kernel audit-logs search --exclude-method so multiple method exclusions (e.g. GET and POST) are applied server-side instead of partially client-side, improving filter accuracy and pagination correctness.

Intended effect:

• /audit-logs error rate: baseline 0–4 errors/hr; confirmed if it stays at or below this after deploy.
• /audit-logs p95 latency: baseline 310–635ms; confirmed if no sustained increase above ~1000ms post-deploy.
• Pagination truncation notice: baseline correct for single-method exclusions; confirmed if "Showing first N results" banner remains accurate with multi-method exclusions.

Risks:

• Backend rejects multi-value param — /audit-logs 4xx rate, alert if errors/hr exceeds 10 for 2+ consecutive hours (baseline: 0–4/hr).
• SDK serializes comma-separated but backend expects repeated params — silent filter bypass; alert if user reports or logs show unexpected method entries in audit log results.
• peekForMore removal changes pagination edge cases — alert if any test run or user report surfaces incorrect truncation notices.

⚠️ Note: OTel pipeline lag of ~5 days detected (2026-07-21, latest data: 2026-07-16). Monitoring queries use 6-day windows to ensure data is available. The monitoring window is also inert until kernel-go-sdk v0.77 is published and kernel/kernel#2706 merges.

Status updates will be posted automatically on this PR as monitoring progresses.

View monitor