Changelog

Double-click and right-click over MCP

• Added doubleClick and button (left, right, or middle) options to the MCP solari_click tool — agents driving a desktop can now open files and icons with a real double click and reach context menus with a right click, without host-side workarounds. Update to @solarisdk/mcp 0.4.4; existing calls behave exactly as before.

Reliable desktop session recordings

• Fixed the recording playback URL so it reaches you — a desktop created with record: true now returns its recordingUrl on the create response and on GET /sandboxes/:id, so you can hand off the replay link without a second lookup. Update to the latest SDK (@solarisdk/sdk 0.1.3, solari-sandbox 0.2.1) to pick it up.
• Fixed recordings across a revert() — start a recording after reverting a desktop to a snapshot and the finished mp4 now uploads to the same playback URL, instead of being silently dropped. (An in-progress recording still ends at the revert, since a revert replaces the whole machine — start a new one after.)

Configurable disk size for sandboxes and desktops

• Added disk_gb on fresh creates — request up to 20 GB and your sandbox or desktop boots with a disk that size (the default template is 4 GB). The size is grown and its filesystem expanded before your first command runs; the API returns the disk size the host actually provisioned. Machines created from_snapshot or by forking keep their snapshot’s disk. Requests above the cap are refused with an explicit 400 rather than silently clamped.
• Heads-up: snapshot storage pricing starts October 1 — $0.05 per GB-month (pro-rated daily) beyond a free 10 GB per organization, billed from your existing credit balance. Nothing is charged for storage held before then, and restoring, forking, and deleting snapshots always keep working. You can trim ancestor snapshots you no longer need to lower the total. Details: docs.getsolari.com/snapshots.

Login handoff for your end users, and safe snapshot reverts

• Fixed profile login links for your end users — the URL from POST /profiles/{id}/login-handoff now opens without a Solari account, so you can hand it straight to your user. Each link carries a single-use credential bound to one profile, expires after 30 minutes, and dies the moment the sign-in is saved.
• Fixed revert() — and made it safe by construction: a revert boots a fresh VM from your snapshot and only swaps it in once it’s up, so a failed revert can never take your running machine down with it.
• Added re-snapshotting of machines created from_snapshot, and deletion of ancestor snapshots while descendants exist — fork → patch → re-snapshot lineages now behave as documented.
• Added clearer errors: snapshot or revert on a paused machine returns 409 NotRunning (“resume it first”), and concurrency-limit errors now say how many slots are held by in-flight creates versus running sessions. GET /sandboxes/:id now returns recordingUrl for desktops created with record: true.
• Removed the browser SDK’s webBotAuth option — it never signed anything, and passing it now returns an explicit 400. If verified bot identity matters to your use case, tell us at hello@getsolari.com.

Free-plan machines from the API, and stronger session isolation

• Added API and SDK access to the Free plan’s included machine — launch your sandbox or desktop with your slr_live_ key, not just from the dashboard. Previously an API create on Free returned 402; the API and the dashboard now agree.
• Fixed dashboard desktop creation, which could fail with a template error.
• Added full profile cleanup between browser sessions — cookies and local storage (including IndexedDB and service workers) are cleared when a session ends, so the next session on the same capacity never sees an earlier session’s data. This affected raw CDP / connectOverCDP clients running back-to-back sessions under one key; Playwright /ws sessions were already isolated.
• Added idempotent creates — retry with the same Idempotency-Key and you get the machine the first request created, never a duplicate. A reused key with a different request returns 409.
• Added strict create validation — an unknown template or an out-of-range timeoutMs, cpu/memMb, or lifecycle now returns 400 before anything is created, instead of quietly starting a default machine. And GET /sessions/:id now reports released once a browser session is closed, so you can confirm teardown by polling.

Fixes across keys, sessions, and proxies

• Fixed new-key activation — a freshly created slr_live_ key now works immediately, instead of being rejected for up to a couple of minutes.
• Fixed the guest clock on resume — sandboxes and desktops wake with the correct time, ending spurious “certificate not yet valid” TLS errors.
• Fixed session status — sessions no longer appear stuck as running after they have ended.
• Fixed port preview URLs that include a path returning 401.
• Restored non-US residential proxy egress.
• Fixed session recordings for CDP / connectOverCDP clients (such as browser-use) — replays now capture the full session, including the final events.
• Upgraded the browser pool to Chromium 151, so Playwright 1.62 clients connect cleanly.

Single API endpoint

Browser, sandbox, and desktop requests now go through one host. Point any SDK at one base URL instead of a hostname per product.

• Added path-based routing — requests to api.getsolari.com reach the right backend automatically.
• Consolidated all products into one region, us-west-1.

One API key, and Go / Rust / C++ SDKs

A single slr_live_ key now works for browsers, sandboxes, and desktops. Previously each product used a separate credential.

• Published Go, Rust, and C++ SDKs to Go modules, crates.io, and CMake FetchContent, alongside the existing TypeScript and Python.
• Added an MCP server (@solarisdk/mcp) for calling Solari from Claude and other agents.
• Split the Python package into solari-core, solari-sandbox, solari-desktop, and solari-browser to match the npm layout.

Sandboxes and desktops GA

Two compute products in addition to the browser. Both boot from a memory snapshot and are usually ready in about a second.

• Sandboxes: headless microVMs with commands, code execution, files, git, snapshots, and templates.
• Desktops: a Linux GUI over VNC, with mouse, keyboard, and screenshot control.
• 1–16 vCPU and up to 64 GB RAM per session, kept across pause and resume.
• Snapshots save and fork machine state. Idle machines pause with state preserved rather than stopping.

Port preview

previewUrl(port) returns a public *.preview.getsolari.com URL for a port running inside a sandbox or desktop.

Cloud browser GA

Cloud Chrome driven with Playwright or a CDP client. Includes stealth mode, managed proxies, captcha solving, profiles, and session recording.