From 3c081940e8377cc540d49be51e870e665633b4cf Mon Sep 17 00:00:00 2001 From: Rafael Date: Fri, 30 Oct 2026 15:50:46 -0400 Subject: [PATCH 1/5] Make MCP coverage reports cover the whole evergreen PR (#15) Co-authored-by: rgarcia <72655+rgarcia@users.noreply.github.com> --- .github/prompts/update-mcp-coverage.md | 15 ++++++++++++--- .github/workflows/update-mcp-coverage.yml | 8 ++++++-- 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/.github/prompts/update-mcp-coverage.md b/.github/prompts/update-mcp-coverage.md index bf086d07..99ac9046 100644 --- a/.github/prompts/update-mcp-coverage.md +++ b/.github/prompts/update-mcp-coverage.md @@ -8,7 +8,9 @@ Do not downgrade or change that version. ## Audit and implement 1. Read `$RUNNER_TEMP/sdk-diff.patch`, `../sdk/api.md`, and the parameter types in - `../sdk/src/resources`. Enumerate SDK methods and their parameters, including + `../sdk/src/resources`. The diff covers every release since the SDK version on + origin/main, so earlier runs may already have covered part of it on this branch. + Enumerate SDK methods and their parameters, including nested options, new enum values, pagination, streaming, and changed signatures. 2. Read `src/lib/mcp/register.ts`, `src/lib/mcp/tools/`, and shared MCP schemas. Map SDK methods/parameters to registered MCP tools, actions, and input fields. @@ -31,10 +33,15 @@ Do not downgrade or change that version. The Kernel API spec as of this SDK release is at `$RUNNER_TEMP/kernel-api/packages/api/openapi.yaml`, and `$RUNNER_TEMP/openapi-diff.patch` -shows spec changes between the previous SDK release and this one. The SDK is generated +shows spec changes between origin/main's SDK release and this one. The SDK is generated from this spec, so its endpoint, parameter, and schema descriptions are the source of truth for what the API does. +The spec is taken from the API's main branch at release time and can be ahead of the +released SDK. The SDK defines what exists: never add tools, actions, or inputs for +operations or fields `../sdk` does not have. Use the spec only for the meaning of +things the SDK has. + 1. For every changed `summary` or `description` in the spec diff that belongs to an endpoint, parameter, or field the MCP server exposes, update the matching tool description, action description, or input `.describe()` text. Use the spec text @@ -68,7 +75,9 @@ unrelated code, workflows, generated App bundles, or authentication configuratio Read the complete diff against origin/main before finishing. Remove unnecessary comments, type casts, defensive wrappers, and unrelated changes. -Write `$RUNNER_TEMP/mcp-coverage-report.md` with concise sections describing: +Write `$RUNNER_TEMP/mcp-coverage-report.md`. It replaces the PR description, so it +must describe every change in the diff against origin/main, including changes earlier +runs left on this branch, not only this run's. Use concise sections describing: - Added or updated MCP tools, actions, and fields, with their SDK counterparts. - Descriptions updated to match spec changes, with the spec operation or field each diff --git a/.github/workflows/update-mcp-coverage.yml b/.github/workflows/update-mcp-coverage.yml index 33d39ec7..11562ebe 100644 --- a/.github/workflows/update-mcp-coverage.yml +++ b/.github/workflows/update-mcp-coverage.yml @@ -147,11 +147,15 @@ jobs: exit 0 fi + # The report replaces the PR description, so audit every release since + # main's SDK version, not only the ones since the last run. + old_version=$(git show origin/main:package.json | jq -er '.dependencies["@onkernel/sdk"]') if git -C ../sdk rev-parse --verify "refs/tags/v$old_version" >/dev/null 2>&1; then - git -C ../sdk diff "refs/tags/v$old_version" "$SDK_SHA" -- api.md src/resources > "$RUNNER_TEMP/sdk-diff.patch" + git -C ../sdk diff "refs/tags/v$old_version" "$SDK_SHA" \ + -- api.md src/client.ts src/lib src/resources > "$RUNNER_TEMP/sdk-diff.patch" echo "old_date=$(TZ=UTC git -C ../sdk log -1 --date=format-local:%Y-%m-%dT%H:%M:%SZ --format=%cd "refs/tags/v$old_version")" >> "$GITHUB_OUTPUT" else - printf 'Baseline %s unavailable; audit all of api.md and src/resources.\n' "$old_version" > "$RUNNER_TEMP/sdk-diff.patch" + printf 'Baseline %s unavailable; audit all of api.md, src/client.ts, src/lib, and src/resources.\n' "$old_version" > "$RUNNER_TEMP/sdk-diff.patch" fi echo "new_date=$(TZ=UTC git -C ../sdk log -1 --date=format-local:%Y-%m-%dT%H:%M:%SZ --format=%cd "$SDK_SHA")" >> "$GITHUB_OUTPUT" echo "update=true" >> "$GITHUB_OUTPUT" From 15c227b28055c40c82087e23cddba3bdcad836f0 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Mon, 2 Nov 2026 23:27:30 +0000 Subject: [PATCH 2/5] feat: Pass through tool_page_unloaded and disable SDK retries for WebMCP invoke failures Stainless-Generated-From: bb2e517c69057a4e5c32d8e0d033dcd8bc6b4922 --- src/resources/browsers/webmcp/webmcp.ts | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/src/resources/browsers/webmcp/webmcp.ts b/src/resources/browsers/webmcp/webmcp.ts index 139f9124..4f3d13ab 100644 --- a/src/resources/browsers/webmcp/webmcp.ts +++ b/src/resources/browsers/webmcp/webmcp.ts @@ -28,9 +28,13 @@ export class Webmcp extends APIResource { * across navigation. Inspect a populated form, obtain any required confirmation, * then submit through Playwright or computer interaction without invoking the tool * again. If the tab or embedded frame disappears, or the request times out after - * invocation begins, the response reports outcome_unknown and the tool is not - * retried. CDP-backed custom tool outputs above 240 KiB return an error rather - * than a truncated result. + * invocation begins, the response reports outcome_unknown. If the tool's page is + * reloaded or replaced by a navigation the tool did not start, and the tool never + * responds, the response reports tool_page_unloaded once the replacement page + * loads, or right away if the tool's tab crashes. Neither failure is retried, and + * both set X-Should-Retry to false because the tool may have had side effects. + * CDP-backed custom tool outputs above 240 KiB return an error rather than a + * truncated result. * * @example * ```ts @@ -84,7 +88,7 @@ export interface CustomToolSource { } export interface InvocationFailure { - code: 'outcome_unknown'; + code: 'outcome_unknown' | 'tool_page_unloaded'; message: string; @@ -113,7 +117,7 @@ export interface InvocationResult { export interface InvokeRequest { /** - * Tool input, limited to 1 MiB after JSON serialization. + * Tool input, limited to 4 MiB after JSON serialization. */ input: { [key: string]: unknown }; @@ -249,7 +253,7 @@ export interface ToolsResponse { export interface WebmcpInvokeToolParams { /** - * Tool input, limited to 1 MiB after JSON serialization. + * Tool input, limited to 4 MiB after JSON serialization. */ input: { [key: string]: unknown }; From 7d574cd28c308cb6e13d16f3a86a88930feb6bf7 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 17:05:03 +0000 Subject: [PATCH 3/5] feat: Drop Kernel's origin gate from 1Password fill Stainless-Generated-From: b15e53cfce245fb3234e10ebee5a3504ce29e98a --- src/resources/vaults/items.ts | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index c9d64206..42fcc82c 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -2427,10 +2427,12 @@ export namespace OnePasswordCredentialVaultItemState { /** * Fill and submit an approved 1Password login in the selected browser page. The - * page must share the selected entry's login origin. Supply entry_id when more - * than one approved entry matches the page origin, and target_id when more than - * one open page has page_url. The extension selects fields; callers cannot supply - * selectors or secret values. Submission does not confirm website authentication. + * 1Password extension decides whether the approved login matches the page and + * refuses pages that don't. Supply entry_id when several entries are approved and + * the page origin does not identify exactly one of them, and target_id when more + * than one open page has page_url. The extension selects fields; callers cannot + * supply selectors or secret values. Submission does not confirm website + * authentication. */ export interface OnePasswordFillVaultItemOperationRequest { /** @@ -2447,8 +2449,8 @@ export interface OnePasswordFillVaultItemOperationRequest { type: '1pw_fill'; /** - * ID of an approved request entry. Required when several approved entries have the - * page's origin. + * ID of an approved request entry. Required when several entries are approved and + * the page's origin does not match exactly one of them. */ entry_id?: string; @@ -4507,8 +4509,8 @@ export declare namespace ItemPerformOperationParams { type: '1pw_fill'; /** - * Body param: ID of an approved request entry. Required when several approved - * entries have the page's origin. + * Body param: ID of an approved request entry. Required when several entries are + * approved and the page's origin does not match exactly one of them. */ entry_id?: string; From 05a01e6dd33052d7fd8efa188111ad0b3ee9c5a8 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 04:08:19 +0000 Subject: [PATCH 4/5] feat: Add single-use Kernel cards to vaults Stainless-Generated-From: b6de3f7ad7c807a19d0b22264a07e7d33f13110a --- api.md | 2 + src/resources/vaults/index.ts | 2 + src/resources/vaults/items.ts | 101 +++++++++++++++++++++++++++++---- src/resources/vaults/vaults.ts | 4 ++ 4 files changed, 99 insertions(+), 10 deletions(-) diff --git a/api.md b/api.md index 8aae8901..bff49bf1 100644 --- a/api.md +++ b/api.md @@ -551,6 +551,7 @@ Types: - KernelCredentialVaultItemSpecInput - KernelCredentialVaultItemState - KernelPaymentRequestVaultItemSpec +- KernelSingleUseCard - KernelWalletState - KernelWalletVaultItemSpec - LinkShippingAddress @@ -582,6 +583,7 @@ Types: - ShopPayCardVaultItemSpec - ShopPayWalletState - ShopPayWalletVaultItemSpec +- SingleUseCardBillingAddress - VaultCardAliases - VaultCardFillField - VaultCheckoutContext diff --git a/src/resources/vaults/index.ts b/src/resources/vaults/index.ts index 2015b0f1..244f2a63 100644 --- a/src/resources/vaults/index.ts +++ b/src/resources/vaults/index.ts @@ -38,6 +38,7 @@ export { type KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState, type KernelPaymentRequestVaultItemSpec, + type KernelSingleUseCard, type KernelWalletState, type KernelWalletVaultItemSpec, type LinkShippingAddress, @@ -69,6 +70,7 @@ export { type ShopPayCardVaultItemSpec, type ShopPayWalletState, type ShopPayWalletVaultItemSpec, + type SingleUseCardBillingAddress, type VaultCardAliases, type VaultCardFillField, type VaultCheckoutContext, diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index 42fcc82c..d17b8235 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -1471,17 +1471,26 @@ export interface FillVaultItemOperationResult { } /** - * A ready Kernel card supports authorize, fill, then submit checkout. Card details - * are delivered for a few minutes after fill; submit promptly. Repeated fill is - * safe and never submits checkout. Visa purchases require a spend_approval action - * before details are issued; Mastercard purchases need no hosted approval. - * masks.last4 is the enrolled card's last four digits; masks.token_last4, when - * present, is the token's last four digits shown to the merchant. Kernel does not - * observe whether the merchant charged the card. + * A ready Kernel card funded by a payment method supports authorize, fill, then + * submit checkout. A single-use card (source single_use_card) is ready on + * creation, supports only fill, and is expired from expires_at; Kernel deletes its + * stored details shortly after expires_at. It has no payment_method_id or + * funding_status. Card details are delivered for a few minutes after fill; submit + * promptly. Repeated fill is safe and never submits checkout. Visa purchases + * require a spend_approval action before details are issued; Mastercard purchases + * need no hosted approval. masks.last4 is the enrolled card's last four digits; + * masks.token_last4, when present, is the token's last four digits shown to the + * merchant. Kernel does not observe whether the merchant charged the card. */ export interface KernelCardState { provider: 'kernel'; + /** + * payment_method for a purchase funded by a wallet payment method; single_use_card + * for a card whose details were supplied with single_use_card. + */ + source: 'payment_method' | 'single_use_card'; + /** * pending_authorization waits for cardholder approval on Visa purchases or fresh * security-code collection on alias-mode purchases through the spend_approval @@ -1511,7 +1520,9 @@ export interface KernelCardState { | 'recovery_required'; /** - * Informational registrable domain. Fill is locked to merchant_url's exact origin. + * Informational registrable domain. Fill is locked to merchant_url's exact origin, + * except that a single-use card fills on any https page of this registrable + * domain. */ domains?: Array; @@ -1568,7 +1579,18 @@ export namespace KernelCardState { * after collection. An expired card requires a new purchase. Fill types those * details on merchant_url's origin. The amount, merchant_url and merchant_country * are recorded but do not restrict payment requests sent by the browser. Card - * updates are not supported; delete and create a new item instead. + * updates are not supported; delete and create a new item instead. With + * single_use_card the item is instead a single-use card whose details the caller + * supplies, such as a virtual card from its issuer. It is not funded by a payment + * method, is ready on creation, and supports only fill: Kernel stores the details + * encrypted, never returns them, and fills them on any https page whose + * registrable domain (state.domains) is merchant_url's, including its subdomains. + * Fill does not consume it. From expires_at it is expired and can no longer be + * filled; Kernel deletes its stored details shortly after expires_at. Deleting the + * card, its wallet or its vault deletes them immediately. amount, currency and the + * merchant fields are recorded but not enforced. Repeating the identical request + * returns the existing card; any other request with the same key returns 409, as + * does repeating it once the expired card's details have been deleted. */ export interface KernelCardVaultItemSpec { /** @@ -1597,6 +1619,16 @@ export interface KernelCardVaultItemSpec { */ wallet: string; + /** + * Single-use cards only. From this time the card is expired and can no longer be + * filled; Kernel deletes its stored details shortly after. Deleting the card, its + * wallet or its vault deletes them immediately. Defaults to 2 hours after + * creation, capped at the end of the card's expiry month; a requested time must be + * in the future, at most 24 hours after creation, and not after the end of the + * card's expiry month. Returned in UTC. + */ + expires_at?: string; + /** * Actual merchant category when known. Omit rather than invent a category. */ @@ -1619,9 +1651,20 @@ export interface KernelCardVaultItemSpec { * Omission selects the wallet's default card, ID card, for compatibility with * existing requests; it never falls back to another method, and a wallet without a * default card requires the ID. The purchase is bound to the method's enrolled - * card and network token, so later operations cannot switch funding. + * card and network token, so later operations cannot switch funding. Not allowed + * with single_use_card. */ payment_method_id?: string; + + /** + * Details of a card the caller supplies, such as a single-use virtual card from + * its issuer. Mutually exclusive with payment_method_id. The card details are + * stored encrypted for fill and never returned; reads return only reference. + * Kernel deletes them shortly after the card's expires_at; deleting the card, its + * wallet or its vault deletes them immediately. A card whose expiry month has + * ended is rejected. + */ + single_use_card?: KernelSingleUseCard; } export interface KernelCredentialVaultItemSpec { @@ -1738,6 +1781,22 @@ export interface KernelPaymentRequestVaultItemSpec { merchant_country?: string; } +/** + * Details of a card the caller supplies, such as a single-use virtual card from + * its issuer. Mutually exclusive with payment_method_id. The card details are + * stored encrypted for fill and never returned; reads return only reference. + * Kernel deletes them shortly after the card's expires_at; deleting the card, its + * wallet or its vault deletes them immediately. A card whose expiry month has + * ended is rejected. + */ +export interface KernelSingleUseCard { + /** + * The caller's identifier for the card, such as the issuer's card ID. Returned + * unchanged on reads. + */ + reference?: string; +} + export interface KernelWalletState { provider: 'kernel'; @@ -3075,6 +3134,26 @@ export namespace ShopPayWalletVaultItemSpec { } } +/** + * Billing address filled with the billing\_\* fill fields. Never returned. + */ +export interface SingleUseCardBillingAddress { + city?: string; + + /** + * ISO 3166-1 alpha-2 code. + */ + country?: string; + + line1?: string; + + line2?: string; + + postal_code?: string; + + state?: string; +} + export interface VaultCardAliases { cvc: string; @@ -4953,6 +5032,7 @@ export declare namespace Items { type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState as KernelCredentialVaultItemState, type KernelPaymentRequestVaultItemSpec as KernelPaymentRequestVaultItemSpec, + type KernelSingleUseCard as KernelSingleUseCard, type KernelWalletState as KernelWalletState, type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec, type LinkShippingAddress as LinkShippingAddress, @@ -4984,6 +5064,7 @@ export declare namespace Items { type ShopPayCardVaultItemSpec as ShopPayCardVaultItemSpec, type ShopPayWalletState as ShopPayWalletState, type ShopPayWalletVaultItemSpec as ShopPayWalletVaultItemSpec, + type SingleUseCardBillingAddress as SingleUseCardBillingAddress, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, type VaultCheckoutContext as VaultCheckoutContext, diff --git a/src/resources/vaults/vaults.ts b/src/resources/vaults/vaults.ts index 57b796e1..53f34a35 100644 --- a/src/resources/vaults/vaults.ts +++ b/src/resources/vaults/vaults.ts @@ -48,6 +48,7 @@ import { KernelCredentialVaultItemSpecInput, KernelCredentialVaultItemState, KernelPaymentRequestVaultItemSpec, + KernelSingleUseCard, KernelWalletState, KernelWalletVaultItemSpec, LinkShippingAddress, @@ -79,6 +80,7 @@ import { ShopPayCardVaultItemSpec, ShopPayWalletState, ShopPayWalletVaultItemSpec, + SingleUseCardBillingAddress, VaultCardAliases, VaultCardFillField, VaultCheckoutContext, @@ -320,6 +322,7 @@ export declare namespace Vaults { type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState as KernelCredentialVaultItemState, type KernelPaymentRequestVaultItemSpec as KernelPaymentRequestVaultItemSpec, + type KernelSingleUseCard as KernelSingleUseCard, type KernelWalletState as KernelWalletState, type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec, type LinkShippingAddress as LinkShippingAddress, @@ -351,6 +354,7 @@ export declare namespace Vaults { type ShopPayCardVaultItemSpec as ShopPayCardVaultItemSpec, type ShopPayWalletState as ShopPayWalletState, type ShopPayWalletVaultItemSpec as ShopPayWalletVaultItemSpec, + type SingleUseCardBillingAddress as SingleUseCardBillingAddress, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, type VaultCheckoutContext as VaultCheckoutContext, From a8a321d3967b3831dabd00c0b7c33d8d8daef36e Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 04:13:27 +0000 Subject: [PATCH 5/5] release: 0.140.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 9 +++++++++ package.json | 2 +- src/version.ts | 2 +- 4 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 93396555..593fcf0c 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.139.0" + ".": "0.140.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index a9dfc4ca..e886992f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,14 @@ # Changelog +## [0.140.0](https://github.com/kernel/kernel-node-sdk/compare/v0.139.0...v0.140.0) (2026-11-04) + + +### Features + +* Add single-use Kernel cards to vaults ([05a01e6](https://github.com/kernel/kernel-node-sdk/commit/05a01e6dd33052d7fd8efa188111ad0b3ee9c5a8)) +* Drop Kernel's origin gate from 1Password fill ([7d574cd](https://github.com/kernel/kernel-node-sdk/commit/7d574cd28c308cb6e13d16f3a86a88930feb6bf7)) +* Pass through tool_page_unloaded and disable SDK retries for WebMCP invoke failures ([15c227b](https://github.com/kernel/kernel-node-sdk/commit/15c227b28055c40c82087e23cddba3bdcad836f0)) + ## [0.139.0](https://github.com/kernel/kernel-node-sdk/compare/v0.138.0...v0.139.0) (2026-10-30) diff --git a/package.json b/package.json index a333ae66..36d4ef7d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.139.0", + "version": "0.140.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index d8122e8a..47d5dc0b 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.139.0'; // x-release-please-version +export const VERSION = '0.140.0'; // x-release-please-version