fix: evict deleted browser routes

Drop cached browser routes after successful DELETE /browsers/{id} responses so stale direct-to-VM session URLs are not reused. Cover both the success and failure paths with focused browser routing regressions.

Made-with: Cursor

Author: rgarcia

src/kernel/_client.py

@@ -37,6 +37,7 @@
     strip_direct_vm_auth,
     rewrite_direct_vm_options,
     browser_routing_config_from_env,
+    maybe_evict_deleted_browser_route_from_response,
     maybe_populate_browser_route_cache_from_response,
 )
 
@@ -302,6 +303,7 @@ def _process_response(
         retries_taken: int = 0,
     ) -> ResponseT:
         maybe_populate_browser_route_cache_from_response(response, cache=self.browser_route_cache)
+        maybe_evict_deleted_browser_route_from_response(response, cache=self.browser_route_cache)
         return super()._process_response(
             cast_to=cast_to,
             options=options,
@@ -616,6 +618,7 @@ async def _process_response(
         retries_taken: int = 0,
     ) -> ResponseT:
         maybe_populate_browser_route_cache_from_response(response, cache=self.browser_route_cache)
+        maybe_evict_deleted_browser_route_from_response(response, cache=self.browser_route_cache)
         return await super()._process_response(
             cast_to=cast_to,
             options=options,

src/kernel/lib/browser_routing/routing.py

@@ -4,6 +4,7 @@
 import re
 from typing import Any, Mapping, cast
 from dataclasses import field, dataclass
+from urllib.parse import unquote
 
 import httpx
 
@@ -31,6 +32,7 @@ class BrowserRoutingConfig:
 
 
 _BROWSER_ROUTE_CACHEABLE_PATH = re.compile(r"^/(?:v\d+/)?browsers(?:/[^/]+)?/?$")
+_BROWSER_DELETE_BY_ID_PATH = re.compile(r"^/(?:v\d+/)?browsers/([^/]+)/?$")
 
 
 def browser_routing_config_from_env() -> BrowserRoutingConfig:
@@ -101,6 +103,21 @@ def maybe_populate_browser_route_cache_from_response(response: httpx.Response, *
         return
 
 
+def maybe_evict_deleted_browser_route_from_response(response: httpx.Response, *, cache: BrowserRouteCache) -> None:
+    if not response.is_success or response.request.method.upper() != "DELETE":
+        return
+
+    match = _BROWSER_DELETE_BY_ID_PATH.match(response.request.url.path)
+    if match is None:
+        return
+
+    session_id = unquote(match.group(1)).strip()
+    if not session_id:
+        return
+
+    cache.delete(session_id)
+
+
 def populate_browser_route_cache_from_value(value: object, *, cache: BrowserRouteCache) -> None:
     if isinstance(value, Mapping):
         mapping = cast(Mapping[object, object], value)

tests/test_browser_routing.py

@@ -7,7 +7,7 @@
 import respx
 import pytest
 
-from kernel import Kernel, AsyncKernel
+from kernel import Kernel, AsyncKernel, InternalServerError
 from kernel.lib.browser_routing.util import jwt_from_cdp_ws_url
 from kernel.lib.browser_routing.routing import (
     BrowserRoute,
@@ -190,6 +190,38 @@ def test_only_browser_metadata_endpoints_warm_route_cache() -> None:
     assert response.is_closed is True
 
 
+@respx.mock
+def test_browser_delete_by_id_evicts_route_cache() -> None:
+    delete_route = respx.delete(f"{base_url}/browsers/sess-1").mock(return_value=httpx.Response(204))
+    with Kernel(base_url=base_url, api_key=api_key, _strict_response_validation=True) as client:
+        _cache_browser(client)
+        response = client.browsers.with_raw_response.delete_by_id("sess-1")
+        with pytest.raises(ValueError, match="route cache"):
+            client.browsers.request("sess-1", "GET", "https://example.com")
+
+    assert delete_route.called
+    assert response.is_closed is True
+
+
+@respx.mock
+def test_failed_browser_delete_by_id_keeps_route_cache() -> None:
+    delete_route = respx.delete(f"{base_url}/browsers/sess-1").mock(
+        return_value=httpx.Response(500, json={"error": "boom"})
+    )
+    routed_request = respx.get("http://browser-session.test/browser/kernel/curl/raw").mock(
+        return_value=httpx.Response(200, content=b"ok")
+    )
+    with Kernel(base_url=base_url, api_key=api_key, _strict_response_validation=True) as client:
+        _cache_browser(client)
+        with pytest.raises(InternalServerError):
+            client.browsers.delete_by_id("sess-1")
+        routed = client.browsers.request("sess-1", "GET", "https://example.com")
+
+    assert delete_route.called
+    assert routed.status_code == 200
+    assert routed_request.called
+
+
 def test_browser_route_cache_normalizes_session_id_keys() -> None:
     cache = BrowserRouteCache()
     cache.set(