Changelog

The live session view now takes your clicks and keystrokes properly

• Clicking the live session view now focuses it, and what you type reaches the session — each character once. Clicking could not focus the canvas before, so typing did nothing until you tabbed to it, and then every character arrived twice.
• Backspace, Enter, Tab and the arrow keys now reach the session. Only printable characters got through before, so you could type into a field but not submit, correct or move around it.
• Clicks now land where you aim them, on both browser types. The view mapped every click into a fixed 1280×720 space regardless of the real window size, so clicks landed off-target — and in opposite directions depending on the browser you were running. The view now uses the session’s actual viewport.
• A snapshot that cannot be restored now tells you so, with the reason, instead of failing as a capacity error. A capacity error reads as “try again shortly”, so callers retried a snapshot that could never succeed; you now get a clear refusal the first time and can act on it.

A guided quickstart, personalized invites, and faster, more reliable compute

• Shared sandboxes can now upload and download files. A signed-URL upload previously reported success while the file landed on the underlying machine, not in your sandbox — and full-size transfers no longer need chunking through exec.
• Added a quickstart guide to your dashboard that ticks off each step from first API key to first automation.
• Invite and gift links now open a personalized welcome naming who invited you and the credit you’ll both earn, instead of a plain sign-in page.
• Fixed desktops ignoring their vCPU setting — extra cores were attached but never switched on, so a 2 vCPU desktop reported nproc=1. Both cores are now live at start, with no change on your side.
• Applied the same fix to sandboxes, so every compute product now honours its vCPU setting.
• You can now set a desktop’s disk size at create time, as you already do for CPU and memory. Asking for more than the host allows now fails immediately with the maximum named, instead of quietly giving you less.
• Moved sandboxes and desktops onto machines with twice the memory, so more stay warm and you hit cold starts less often.
• Deploys no longer cut running browser automations short — sessions now get about five minutes to finish, up from 25 seconds.
• Deploys no longer interrupt sandbox and desktop creation — a warm standby always answers while another instance restarts.
• The drag-and-drop tools now work on the hosted MCP connector at mcp.getsolari.com, with no local @solarisdk/mcp install.
• Requests that cannot be placed now fail in about 20 seconds with a Retry-After header, instead of holding your connection open for four minutes. Your retry then arrives once a slot has actually freed.
• Fixed concurrent-sandbox slots not being returned on shared machines, so your concurrency limit now tracks what you are actually running.

Drag-and-drop over MCP, and per-session usage metering

• Added drag-and-drop to the MCP desktop tools — solari_drag, plus solari_mouse_down / solari_mouse_move / solari_mouse_up for press-hold-release. Update to @solarisdk/mcp 0.4.5.
• Added a per-session usage API — GET /api/v1/usage/sessions (and /:id) returns proxy GB, compute minutes and actual billed cost per browser session, plus totals over any date range.

More concurrent stealth browsers on every plan

• Raised the concurrent stealth browser limit on every paid plan — Starter 3 → 10, Professional 10 → 50, Enterprise 15 → 75.
• Expanded the stealth browser fleet fivefold and made it add capacity earlier in a ramp, so bursts are absorbed instead of returning 503.
• Fixed sessions that ended uncleanly holding concurrency slots after they finished.

Your newest sandboxes, sessions and keys are listed first

• Changed the Sandboxes, Desktops, Sessions and API keys lists to newest-first, so what you just created is at the top.

Your plan’s monthly credits now always land

• Fixed monthly plan credits not being deposited on some paid accounts, which showed as “Insufficient credit balance” on an account you had just paid for. Affected accounts have been credited.
• Credits are now deposited on demand as well as at payment time, so a delayed payment notification can no longer leave your balance short.

New infrastructure, stronger session guarantees, and double-click over MCP

• Moved the whole platform onto new, fully redundant infrastructure across multiple zones. Same domain, same keys, same API, everything carried over. Capacity now scales with demand rather than in fixed steps, so bursts are absorbed with fewer 503s.
• Upgraded stealth browsers to current-generation GPUs, so the full-Chromium pool renders on real hardware and fingerprints keep looking like a real desktop.
• Added edge protection in front of the API and console, and version protection for session recordings and volumes — an accidental overwrite or delete can now be recovered on request.
• Fixed browser sessions lingering as active — a session never connected, or past its deadline, is now torn down and reported released by GET /sessions/:id.
• Hardened session identifiers and login-handoff tokens so they no longer carry readable internal details. Treat both as opaque strings, as documented.
• Fixed replay lookups to distinguish “still processing” from “unavailable”, so you can poll for a recording instead of treating it as missing.
• Added doubleClick and button (left, right, middle) to the MCP solari_click tool, so agents can open icons with a real double click and reach context menus. Update to @solarisdk/mcp 0.4.4; existing calls are unchanged.

Reliable desktop session recordings

• Fixed the recording playback URL — a desktop created with record: true now returns recordingUrl on create and on GET /sandboxes/:id, with no second lookup. Needs @solarisdk/sdk 0.1.3 or solari-sandbox 0.2.1.
• Fixed recordings across a revert() — a recording started after a revert now uploads to the same playback URL instead of being dropped. An in-progress recording still ends at the revert, since a revert replaces the machine.

Configurable disk size for sandboxes and desktops

• Added disk_gb on fresh creates — up to 20 GB, grown and expanded before your first command runs (the default template is 4 GB). Machines created from_snapshot keep their snapshot’s disk, and requests above the cap return 400 rather than being silently clamped.
• Heads-up: snapshot storage pricing starts October 1 — $0.05 per GB-month, pro-rated daily, beyond a free 10 GB per organization and billed from your credit balance. Storage held before then is not charged, and restore, fork and delete keep working. Details: docs.getsolari.com/snapshots.

Login handoff for your end users, and safe snapshot reverts

• Fixed profile login links — the URL from POST /profiles/{id}/login-handoff now opens without a Solari account, so you can hand it straight to your user. Single-use, bound to one profile, expires after 30 minutes or the moment the sign-in is saved.
• Fixed revert() and made it safe by construction — it boots a fresh VM from your snapshot and swaps it in only once it is up, so a failed revert cannot take your running machine down.
• Added re-snapshotting of machines created from_snapshot, and deletion of ancestor snapshots while descendants exist, so fork → patch → re-snapshot lineages behave as documented.
• Added clearer errors — snapshot or revert on a paused machine returns 409 NotRunning, and concurrency errors now say how many slots are held by in-flight creates versus running sessions.
• Removed the browser SDK’s webBotAuth option — it never signed anything, and passing it now returns 400. If verified bot identity matters to you, tell us at hello@getsolari.com.

Free-plan machines from the API, and stronger session isolation

• Added API and SDK access to the Free plan’s included machine — launch it with your slr_live_ key, not just from the dashboard. An API create on Free previously returned 402.
• Fixed dashboard desktop creation, which could fail with a template error.
• Added full profile cleanup between browser sessions — cookies and local storage, including IndexedDB and service workers, are cleared at session end. This affected raw CDP clients running back-to-back sessions under one key; Playwright /ws sessions were already isolated.
• Added idempotent creates — retry with the same Idempotency-Key and you get the original machine, never a duplicate. A reused key with a different request returns 409.
• Added strict create validation — an unknown template or out-of-range timeoutMs, cpu / memMb or lifecycle now returns 400 before anything is created, instead of quietly starting a default machine.

Fixes across keys, sessions, and proxies

• Fixed new-key activation — a freshly created slr_live_ key now works immediately instead of being rejected for a couple of minutes.
• Fixed the guest clock on resume — sandboxes and desktops wake with the correct time, ending spurious “certificate not yet valid” TLS errors.
• Fixed session status — sessions no longer appear stuck as running after they have ended.
• Fixed port preview URLs that include a path returning 401.
• Restored non-US residential proxy egress.
• Fixed session recordings for CDP / connectOverCDP clients (such as browser-use) — replays now capture the full session, including the final events.
• Upgraded the browser pool to Chromium 151, so Playwright 1.62 clients connect cleanly.

Single API endpoint

Browser, sandbox, and desktop requests now go through one host. Point any SDK at one base URL instead of a hostname per product.

• Added path-based routing — requests to api.getsolari.com reach the right backend automatically.
• Consolidated all products into one region, us-west-1.

One API key, and Go / Rust / C++ SDKs

A single slr_live_ key now works for browsers, sandboxes, and desktops. Previously each product used a separate credential.

• Published Go, Rust, and C++ SDKs to Go modules, crates.io, and CMake FetchContent, alongside the existing TypeScript and Python.
• Added an MCP server (@solarisdk/mcp) for calling Solari from Claude and other agents.
• Split the Python package into solari-core, solari-sandbox, solari-desktop, and solari-browser to match the npm layout.

Sandboxes and desktops GA

Two compute products in addition to the browser. Both boot from a memory snapshot and are usually ready in about a second.

• Sandboxes: headless microVMs with commands, code execution, files, git, snapshots, and templates.
• Desktops: a Linux GUI over VNC, with mouse, keyboard, and screenshot control.
• 1–16 vCPU and up to 64 GB RAM per session, kept across pause and resume.
• Snapshots save and fork machine state. Idle machines pause with state preserved rather than stopping.

Port preview

previewUrl(port) returns a public *.preview.getsolari.com URL for a port running inside a sandbox or desktop.

Cloud browser GA

Cloud Chrome driven with Playwright or a CDP client. Includes stealth mode, managed proxies, captcha solving, profiles, and session recording.