From 9f26e5df48d63477e604cd18be8453d4d161449d Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Sat, 26 Sep 2026 15:21:19 +0000
Subject: [PATCH] Fix Kernel sandbox network access

Signed-off-by: rgarcia <72655+rgarcia@users.noreply.github.com>
---
 spec.yaml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/spec.yaml b/spec.yaml
index 7aba20c..da79579 100644
--- a/spec.yaml
+++ b/spec.yaml
@@ -10,8 +10,10 @@ licenses:
 permissions:
   network:
     allow:
-      # Kernel REST API and regional CDP WebSocket proxy hosts.
-      - '*.onkernel.com'
+      # Kernel REST API and regional proxy-based CDP endpoints.
+      - '**.onkernel.com'
+      # Direct CDP endpoints returned by Kernel in some metros.
+      - '*.kernel.sh'
       # Package registries used when agents add a Kernel SDK.
       - registry.npmjs.org
       - '*.npmjs.org'
@@ -22,6 +24,10 @@ permissions:
       - objects.githubusercontent.com
       - release-assets.githubusercontent.com
 
+environment:
+  variables:
+    KERNEL_NO_UPDATE_CHECK: "1"
+
 credentials:
   - service: kernel
     description: Kernel API key