feat: route browser telemetry directly to the VM by default

Telemetry is now a default direct-to-VM routing subresource. The
telemetry stream method path is changed from /browsers/{id}/telemetry to
/browsers/{id}/telemetry/stream so it mirrors the browser VM endpoint:
when the request is rewritten for direct routing it yields
{base_url}/telemetry/stream, which is the SSE stream on the VM (the VM's
/telemetry is a different, non-stream JSON endpoint).

"telemetry" is added to the default KERNEL_BROWSER_ROUTING_SUBRESOURCES
allowlist alongside "curl".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rgarcia

api.md

@@ -143,7 +143,7 @@ from kernel.types.browsers import (
 
 Methods:
 
-- <code title="get /browsers/{id}/telemetry">client.browsers.telemetry.<a href="./src/kernel/resources/browsers/telemetry.py">stream</a>(id) -> <a href="./src/kernel/types/browsers/telemetry_stream_response.py">TelemetryStreamResponse</a></code>
+- <code title="get /browsers/{id}/telemetry/stream">client.browsers.telemetry.<a href="./src/kernel/resources/browsers/telemetry.py">stream</a>(id) -> <a href="./src/kernel/types/browsers/telemetry_stream_response.py">TelemetryStreamResponse</a></code>
 
 ## Replays
 

src/kernel/lib/browser_routing/routing.py

@@ -41,7 +41,7 @@ class BrowserRoutingConfig:
 def browser_routing_config_from_env() -> BrowserRoutingConfig:
     raw = os.environ.get("KERNEL_BROWSER_ROUTING_SUBRESOURCES")
     if raw is None:
-        return BrowserRoutingConfig(subresources=("curl",))
+        return BrowserRoutingConfig(subresources=("curl", "telemetry"))
     if raw.strip() == "":
         return BrowserRoutingConfig()
 

src/kernel/resources/browsers/telemetry.py

@@ -80,7 +80,7 @@ def stream(
         extra_headers = {"Accept": "text/event-stream", **(extra_headers or {})}
         extra_headers = {**strip_not_given({"Last-Event-ID": last_event_id}), **(extra_headers or {})}
         return self._get(
-            path_template("/browsers/{id}/telemetry", id=id),
+            path_template("/browsers/{id}/telemetry/stream", id=id),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
             ),
@@ -149,7 +149,7 @@ async def stream(
         extra_headers = {"Accept": "text/event-stream", **(extra_headers or {})}
         extra_headers = {**strip_not_given({"Last-Event-ID": last_event_id}), **(extra_headers or {})}
         return await self._get(
-            path_template("/browsers/{id}/telemetry", id=id),
+            path_template("/browsers/{id}/telemetry/stream", id=id),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
             ),

tests/test_browser_routing.py

@@ -97,6 +97,28 @@ def test_browser_request_uses_curl_raw() -> None:
     assert request.url.params.get("jwt") == "token-abc"
 
 
+@respx.mock
+def test_telemetry_stream_routes_directly_to_vm(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("KERNEL_BROWSER_ROUTING_SUBRESOURCES", "telemetry")
+    route = respx.get("http://browser-session.test/browser/kernel/telemetry/stream").mock(
+        return_value=httpx.Response(
+            200,
+            headers={"content-type": "text/event-stream"},
+            content=b'id: 1\ndata: {"category":"api"}\n\n',
+        )
+    )
+    with Kernel(base_url=base_url, api_key=api_key, _strict_response_validation=True) as client:
+        _cache_browser(client)
+        stream = client.browsers.telemetry.stream("sess-1")
+        stream.close()
+
+    assert route.called
+    request = cast(httpx.Request, cast(Any, route.calls[0]).request)
+    assert request.url.path == "/browser/kernel/telemetry/stream"
+    assert request.url.params.get("jwt") == "token-abc"
+    assert request.headers.get("Authorization") is None
+
+
 @respx.mock
 def test_browser_request_params_cannot_override_target_url_or_jwt() -> None:
     route = respx.get("http://browser-session.test/browser/kernel/curl/raw").mock(
@@ -315,7 +337,7 @@ def test_browser_route_from_browser_requires_base_url_and_jwt() -> None:
 
 def test_browser_routing_config_from_env_defaults_to_curl(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.delenv("KERNEL_BROWSER_ROUTING_SUBRESOURCES", raising=False)
-    assert browser_routing_config_from_env().subresources == ("curl",)
+    assert browser_routing_config_from_env().subresources == ("curl", "telemetry")
 
 
 def test_browser_routing_config_from_env_empty_string_disables_routing(monkeypatch: pytest.MonkeyPatch) -> None: