Add profile data source

[IlyaasK]

What changed

• Adds the kernel_profile data source with id or exact name lookup.
• Uses project-scoped Kernel SDK profile calls through the durable internal/kernelclient wrapper.
• Shares selector and response-field validation helpers between project/profile data sources.
• Adds manual list-page support for profile/project exact lookup, including fail-closed pagination diagnostics when X-Has-More is inconsistent with X-Next-Offset.
• Registers kernel_profile with the provider and adds focused unit tests.

Intentionally unsupported

• No profile resource or profile mutation support.
• No browser/session runtime operations.
• No last_used_at or updated_at in Terraform state because profile runtime load/save paths can change them.
• No fallback to provider project_id for profile selection; kernel_profile requires explicit id or name.
• No fuzzy lookup selection; name lookup must resolve to exactly one exact match.

Tests run

• GOCACHE=/private/tmp/terraform-provider-kernel-go-cache go test ./internal/datasources/... ./internal/kernelclient ./internal/provider
• GOCACHE=/private/tmp/terraform-provider-kernel-go-cache go test ./...
• GOCACHE=/private/tmp/terraform-provider-kernel-go-cache go vet ./...
• git diff --check project-data-source
• git diff --check project-data-source..HEAD
• gofmt -l on changed Go files

Review gates

All five review gates passed after accepted fixes were applied and tests were rerun:

• deslop: all good
• autoreview: clean, no accepted/actionable findings
• thermo-nuclear-code-quality-review: all good
• dave cheney Go architecture review: all good
• eblog review: all good

---

Note

Medium Risk
New data source and changed project name-lookup behavior affect how users resolve projects and profiles; pagination and API response validation are security-relevant for correct targeting but are well-tested.

Overview
Adds kernel_profile so Terraform can read durable profile metadata by id or exact name, with optional project_id scoping and only created_at in state (no runtime updated_at / last_used_at).

Introduces shared internal/datasources helpers for id/name selectors and validating API JSON fields; kernel_project now uses them and resolves name lookups with a single GetProject call instead of paginated list scans, with a guard when a configured name collides with another project’s id.

kernelclient gains ListProfilePage and generic pagination that honors X-Has-More over stale X-Next-Offset; ListProjectPage is removed. projectscope.ResolveDataSource errors on unknown project_id during data source reads.

^{Reviewed by Cursor Bugbot for commit 74bbda8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Created a monitoring plan for this PR.

What this PR does: Adds a kernel_profile data source to the Terraform provider, letting users look up Kernel profile metadata (id, name, created_at) by ID or exact name in infrastructure-as-code. Also refactors shared validation and pagination helpers from the project data source into a reusable package.

Intended effect:

• CI check runs on this repo: baseline all passing (8+ consecutive successes today, Jun 5); confirmed if HEAD SHA 1b537923 completes conclusion=success
• Provider data source count: baseline 1 (kernel_project); confirmed if provider_test assertion passes with 2 data sources registered (kernel_project, kernel_profile)
• Absent runtime fields: baseline no updated_at/last_used_at in project state; confirmed if schema test asserts those attributes are absent from kernel_profile

No production API telemetry applies — this is a Terraform provider change that is dormant until users upgrade their provider version and adopt the new data source.

Risks:

• Profile API pagination mismatch — if the Kernel /profiles list endpoint returns X-Has-More: true without X-Next-Offset, users see "Kernel profile pagination reported more results without a next offset"; alert if any user reports this error
• Project data source regression — kernel_project read logic was refactored to shared helpers; alert on any CI failure in the project package or user-reported project plan breakage post-upgrade
• Provider init panic — second data source registration could surface plugin framework edge cases; alert if any terraform init/plan crash is reported after provider release

Status updates will be posted automatically on this PR as monitoring progresses.

View monitor

[linear-code]

KERNEL-1458 Ship v0 Terraform provider for browser pools

tldr

Ship a v0 Kernel Terraform provider for Framer that manages browser pools only. Keep broader durable Kernel resources, including profiles, projects, and API keys, deferred until after the browser-pool MVP is working and reviewed.

Problem

Framer asked for Terraform-managed Kernel infrastructure, and the immediate useful surface is browser pools. The provider should model durable desired state, not runtime browser/session operations. Recent API/SDK contract work has already been done to make this viable.

Customer

Framer.

v0 scope

• Provider config: api_key, optional base_url, optional project_id.
• Resource: kernel_browser_pool with create/read/update/delete and import support.
• Read-only data sources needed for browser-pool references except profiles if they would expand scope beyond the browser-pool MVP.
• Docs/examples for a Framer-style production pool and project-scoped usage.
• CI, release checklist, generated Terraform docs, and security checklist for the v0 provider.
• Keep the provider narrow for v0: no kernel_profile, no kernel_project, no kernel_api_key, and no browser session/acquire/release/runtime resources.

Deferred / follow-up scope

• Terraform support for Kernel profiles should be added after v0, not in the browser-pool MVP.
• The existing profile-related provider PR/context can be used later as follow-up planning, but should not gate v0.

Plan and repo

• Provider repo: https://github.com/kernel/terraform-provider-kernel
• Implementation plan: https://docs.google.com/document/d/1Ok0dLQ-h06lWbfjVdBIMoGxymZi9cf-pl1m6DSDOu2o/edit?usp=sharing

Terraform provider PR context

Merged foundation:

• Scaffold Kernel Terraform provider #1 scaffold provider repo
• Add provider configuration #2 provider config/auth
• Add SDK durable client wrapper #3 SDK durable client wrapper

Open v0 stack should stay browser-pool focused:

• Add browser pool schema and JSON normalization #5 browser-pool schema and JSON normalization
• Add browser pool create expand helper #6/Add browser pool flatten helpers #7 expand/flatten helpers
• Add browser pool create/read logic #8 create/read logic
• Add browser pool update patch builder #9/Wire browser pool update resource #10 update path
• Add browser pool delete resource #11 delete path
• Add browser pool import support #12 import support
• Add acceptance test harness #17/Add browser pool acceptance test #18 acceptance harness and browser-pool acceptance test
• Add README quickstart #19-Add release and security checklist #23 quickstart, examples, generated docs, CI, release/security checklist

Potential follow-up data-source work after v0:

• Add project data source #13 project data source
• Add profile data source #14 profile data source
• Add proxy data source #15 proxy data source
• Add extension data source #16 extension data source

API changes made for Terraform/provider correctness

• kernel/kernel#2386 corrected project-scoping descriptions in the OpenAPI spec.
• kernel/kernel#2387 made default-project context resolution consistent for Terraform-style explicit project scoping.
• kernel/kernel#2392 added a typed SDK project_id option mapped to X-Kernel-Project-Id.
• kernel/kernel#2447 aligned browser-pool timeout/viewport/fill-rate contract with implementation and fixed the update-side save_changes rejection.
• kernel/kernel#2484 removes save_changes from browser-pool profile params by introducing a pool-specific BrowserPoolProfile schema, so generated SDKs do not expose a field pool create/update reject.

SDK release context

• release: 0.70.0 kernel-go-sdk#125 release 0.70.0 includes the browser-pool contract updates.
• release: 0.70.0 kernel-node-sdk#130 release 0.70.0 includes the browser-pool contract updates.
• release: 0.70.0 kernel-python-sdk#121 release 0.70.0 includes the browser-pool contract updates.

Acceptance criteria

• kernel_browser_pool CRUD is idempotent and drift-safe.
• Import sets the canonical browser-pool ID/state correctly.
• Project scoping is explicit and does not accidentally send a project header for unscoped calls.
• Sensitive values stay sensitive in Terraform state/logs.
• Unit tests cover schema/model/helpers and SDK/client wiring.
• Acceptance tests cover browser-pool create/read/update/delete/import against live Kernel when credentials are present.
• Docs clearly state that profiles, projects, API keys, and runtime browser/session operations are intentionally unsupported in v0.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit f68f78e. Configure here.}

[tnsardesai]

reviewed — clean PR. generic Page[T], the shared datasources helpers, and the profile/project name-lookup split all read well, and the profile test suite covers the tricky paths (nullable name, id-mismatch guard, ambiguous name). build + tests pass locally.

Nits

• internal/datasources/helpers.go — the new datasources package has no direct test file (go test reports [no test files]); ResolveIDNameSelector / ValidResponseString / ValidResponseTime are only covered transitively through project/profile. consider a small table test now that they're shared surface area.

[IlyaasK]

Thanks @tnsardesai — nit addressed, plus the three Bugbot findings on this PR are now resolved (replies on each thread).

Nit — no direct tests for the shared datasources package: added internal/datasources/helpers_test.go with table tests over the shared surface: ResolveIDNameSelector (id/name/neither/conflict/unknown/empty — 8 cases with summary assertions), ValidResponseString and ValidResponseTime (present/absent/null raw, invalid field flag, wrong JSON type, raw-vs-decoded disagreement), and FieldPresent. go test ./internal/datasources/ no longer reports [no test files].

Also folded in on this head: profile scan hardening (filter-first + match-only validation + dedupe-by-id), a name-collision guard on the project Get path, and authoritative X-Has-More: false handling in pagination — details on the Bugbot threads. Head 74bbda8; full internal test suite green on every branch in the stack.