Changelog

A guided quickstart, personalized invites, and faster, more reliable compute

• Added a quickstart guide to your dashboard that tracks your progress — it takes you from your first API key to your first automation and ticks off each step as you finish it, so getting started is a checklist instead of a hunt through the docs.
• Invite and gift links now open a personalized welcome — a referral link greets you with who invited you and the credit you’ll both earn, and a promo link shows the gift waiting for you, instead of dropping you on a plain sign-in page.
• Fixed a bug where a desktop given more than one vCPU still ran on one — the extra cores were attached but never switched on inside the guest, so a desktop requesting 2 vCPUs reported nproc=1 and did the work of a single core. Both cores are now live the moment the desktop starts, so CPU-bound work — builds, video encoding, heavy page rendering — runs at the speed you are paying for, with no change needed on your side.
• Applied the same fix to sandboxes earlier this week, so every compute product now honours its vCPU setting.
• Moved sandboxes and desktops onto machines with twice the memory, so more of them stay warm at once — you hit a cold start less often, and a fresh sandbox or desktop starts instantly more of the time.
• Fixed how concurrent-sandbox slots are counted on shared machines — finishing with a sandbox now reliably returns its slot, so your plan’s concurrency limit tracks exactly what you’re running. If you’d hit your limit while running fewer sandboxes than your plan allows, that no longer happens.

Drag-and-drop over MCP, and per-session usage metering

• Added drag-and-drop to the MCP desktop tools — solari_drag for a one-shot drag, plus solari_mouse_down / solari_mouse_move / solari_mouse_up for press-hold-release — so an agent can move windows, drag sliders, and drop files, not just click. Update to @solarisdk/mcp 0.4.5.
• Added a per-session usage API — GET /api/v1/usage/sessions (and /:id), authenticated with your slr_live_ key — returning proxy GB, compute minutes, and the actual billed cost for each browser session, plus totals over any date range. So you can measure cost-per-scrape and price a daily-vs-weekly cadence from real bytes instead of estimating from page weights.

More concurrent stealth browsers on every plan

• Raised the concurrent stealth browser limit on every paid plan — Starter goes from 3 to 10, Professional from 10 to 50, Enterprise from 15 to 75 — so you can run far more anti-bot sessions in parallel without hitting StealthConcurrencyLimitExceeded.
• Expanded the stealth browser fleet fivefold behind the scenes, and made it add capacity earlier during a traffic ramp, so bursts are absorbed instead of returning 503.
• Fixed a bug where sessions that ended uncleanly could hold onto your concurrency slots long after they finished — so your limit now reflects what you are actually running.

Your newest sandboxes, sessions and keys are listed first

• Changed the default order of the Sandboxes, Desktops, Sessions and API keys lists to newest-first — the item you just created now sits at the top instead of the bottom, so you are not paging to the end to find it.

Your plan’s monthly credits now always land

• Fixed monthly plan credits not being deposited on some paid accounts — so a Starter or Pro subscription now always has its allowance available, and you no longer see “Insufficient credit balance” on an account you have just paid for. Affected accounts have been credited; nothing to do on your side.
• Credits are now deposited on demand as well as at payment time, so a delayed or missed payment notification can no longer leave your balance short.

New infrastructure, stronger session guarantees, and double-click over MCP

• Moved the whole platform — cloud browsers, sandboxes, desktops, and the console — onto new, fully redundant infrastructure spread across multiple zones. Same domain, same API keys, same API; your profiles, recordings, volumes, and account carried over, and nothing changes on your side. Capacity now scales with demand rather than in fixed steps, so bursts are absorbed with fewer 503s.
• Upgraded stealth browsers to current-generation GPUs — real hardware rendering for the full-Chromium pool, so fingerprints keep looking like a real desktop.
• Added edge protection in front of the API and console, and version protection for session recordings and volumes — an accidental overwrite or delete can now be recovered on request.
• Fixed browser session lifecycle so every session ends cleanly — a session that is created but never connected, or that hits its deadline, is now torn down and reported as released by GET /sessions/:id instead of lingering as active.
• Hardened session identifiers and login-handoff tokens so they no longer carry readable internal details. Existing integrations are unaffected: treat both as opaque strings, as documented.
• Fixed replay lookups to distinguish “still processing” from “unavailable”, so you can poll for a recording that is on its way instead of treating it as missing.
• Added doubleClick and button (left, right, or middle) options to the MCP solari_click tool — agents driving a desktop can now open files and icons with a real double click and reach context menus with a right click, without host-side workarounds. Update to @solarisdk/mcp 0.4.4; existing calls behave exactly as before.

Reliable desktop session recordings

• Fixed the recording playback URL so it reaches you — a desktop created with record: true now returns its recordingUrl on the create response and on GET /sandboxes/:id, so you can hand off the replay link without a second lookup. Update to the latest SDK (@solarisdk/sdk 0.1.3, solari-sandbox 0.2.1) to pick it up.
• Fixed recordings across a revert() — start a recording after reverting a desktop to a snapshot and the finished mp4 now uploads to the same playback URL, instead of being silently dropped. (An in-progress recording still ends at the revert, since a revert replaces the whole machine — start a new one after.)

Configurable disk size for sandboxes and desktops

• Added disk_gb on fresh creates — request up to 20 GB and your sandbox or desktop boots with a disk that size (the default template is 4 GB). The size is grown and its filesystem expanded before your first command runs; the API returns the disk size the host actually provisioned. Machines created from_snapshot or by forking keep their snapshot’s disk. Requests above the cap are refused with an explicit 400 rather than silently clamped.
• Heads-up: snapshot storage pricing starts October 1 — $0.05 per GB-month (pro-rated daily) beyond a free 10 GB per organization, billed from your existing credit balance. Nothing is charged for storage held before then, and restoring, forking, and deleting snapshots always keep working. You can trim ancestor snapshots you no longer need to lower the total. Details: docs.getsolari.com/snapshots.

Login handoff for your end users, and safe snapshot reverts

• Fixed profile login links for your end users — the URL from POST /profiles/{id}/login-handoff now opens without a Solari account, so you can hand it straight to your user. Each link carries a single-use credential bound to one profile, expires after 30 minutes, and dies the moment the sign-in is saved.
• Fixed revert() — and made it safe by construction: a revert boots a fresh VM from your snapshot and only swaps it in once it’s up, so a failed revert can never take your running machine down with it.
• Added re-snapshotting of machines created from_snapshot, and deletion of ancestor snapshots while descendants exist — fork → patch → re-snapshot lineages now behave as documented.
• Added clearer errors: snapshot or revert on a paused machine returns 409 NotRunning (“resume it first”), and concurrency-limit errors now say how many slots are held by in-flight creates versus running sessions. GET /sandboxes/:id now returns recordingUrl for desktops created with record: true.
• Removed the browser SDK’s webBotAuth option — it never signed anything, and passing it now returns an explicit 400. If verified bot identity matters to your use case, tell us at hello@getsolari.com.

Free-plan machines from the API, and stronger session isolation

• Added API and SDK access to the Free plan’s included machine — launch your sandbox or desktop with your slr_live_ key, not just from the dashboard. Previously an API create on Free returned 402; the API and the dashboard now agree.
• Fixed dashboard desktop creation, which could fail with a template error.
• Added full profile cleanup between browser sessions — cookies and local storage (including IndexedDB and service workers) are cleared when a session ends, so the next session on the same capacity never sees an earlier session’s data. This affected raw CDP / connectOverCDP clients running back-to-back sessions under one key; Playwright /ws sessions were already isolated.
• Added idempotent creates — retry with the same Idempotency-Key and you get the machine the first request created, never a duplicate. A reused key with a different request returns 409.
• Added strict create validation — an unknown template or an out-of-range timeoutMs, cpu/memMb, or lifecycle now returns 400 before anything is created, instead of quietly starting a default machine. And GET /sessions/:id now reports released once a browser session is closed, so you can confirm teardown by polling.

Fixes across keys, sessions, and proxies

• Fixed new-key activation — a freshly created slr_live_ key now works immediately, instead of being rejected for up to a couple of minutes.
• Fixed the guest clock on resume — sandboxes and desktops wake with the correct time, ending spurious “certificate not yet valid” TLS errors.
• Fixed session status — sessions no longer appear stuck as running after they have ended.
• Fixed port preview URLs that include a path returning 401.
• Restored non-US residential proxy egress.
• Fixed session recordings for CDP / connectOverCDP clients (such as browser-use) — replays now capture the full session, including the final events.
• Upgraded the browser pool to Chromium 151, so Playwright 1.62 clients connect cleanly.

Single API endpoint

Browser, sandbox, and desktop requests now go through one host. Point any SDK at one base URL instead of a hostname per product.

• Added path-based routing — requests to api.getsolari.com reach the right backend automatically.
• Consolidated all products into one region, us-west-1.

One API key, and Go / Rust / C++ SDKs

A single slr_live_ key now works for browsers, sandboxes, and desktops. Previously each product used a separate credential.

• Published Go, Rust, and C++ SDKs to Go modules, crates.io, and CMake FetchContent, alongside the existing TypeScript and Python.
• Added an MCP server (@solarisdk/mcp) for calling Solari from Claude and other agents.
• Split the Python package into solari-core, solari-sandbox, solari-desktop, and solari-browser to match the npm layout.

Sandboxes and desktops GA

Two compute products in addition to the browser. Both boot from a memory snapshot and are usually ready in about a second.

• Sandboxes: headless microVMs with commands, code execution, files, git, snapshots, and templates.
• Desktops: a Linux GUI over VNC, with mouse, keyboard, and screenshot control.
• 1–16 vCPU and up to 64 GB RAM per session, kept across pause and resume.
• Snapshots save and fork machine state. Idle machines pause with state preserved rather than stopping.

Port preview

previewUrl(port) returns a public *.preview.getsolari.com URL for a port running inside a sandbox or desktop.

Cloud browser GA

Cloud Chrome driven with Playwright or a CDP client. Includes stealth mode, managed proxies, captcha solving, profiles, and session recording.