feat: route process calls directly to browser VMs

[tnsardesai]

summary

• add process to the default direct-to-VM browser routing allowlist
• cover process exec, spawn, kill, resize, status, stdin, and stdout streaming through the existing prefix matcher
• keep fs/* and telemetry/events on the control plane and preserve the environment override/kill switch

testing

• yarn test (410 passed, 227 skipped)
• yarn lint
• live browser validation: exec, spawn, and stdout streaming routed through /browser/kernel/process/... and returned the expected output

release

This PR targets next. After merge, release-please opens or updates the versioned next → main release PR. Merging that release PR publishes the npm package.

---

Note

Medium Risk
Default routing for all process/* browser calls changes from control plane to VM, which affects latency, failure modes, and auth for existing SDK users unless they override env; scope is limited to browser subresource routing with existing JWT fallback behavior.

Overview
Adds process to the default direct-to-VM browser routing allowlist in browser-routing.ts, so paths like process/exec and process/.../stdout/stream match the existing prefix rules and are sent to the session VM (JWT on the VM URL, API authorization stripped) instead of the control plane API origin.

fs/* and telemetry/events remain on the API by default; KERNEL_BROWSER_ROUTING_SUBRESOURCES still overrides or disables routing when set.

Tests now expect process in the default list, assert prefix matching for process paths, include process.exec in the default VM routing integration test, and drop process from the “stays on API origin” case.

^{Reviewed by Cursor Bugbot for commit 9e1a053. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Sayan-]

Verified at 9e1a053. All 7 public process paths map to matching instance paths, the control-plane handlers have no gating or persistence, 23 tests pass. Method coverage is adequate: process/exec covers routed POST, telemetry/stream already covers routed GET and SSE.

Worth pinning: the fallback replays on any 401/403 carrying a jwt, which is safe only because metro-api rejects in verifySession before reaching the VM and no process endpoint declares 401/403 on the instance. If either changes, a replayed exec double-executes.

Pre-existing: matchesDirectVMPrefix doesn't trim its prefixes, unlike Python's.

The base branch was changed.