[kernel-internal]

Automated Release PR

0.140.0 (2026-11-04)

Features

• Add single-use Kernel cards to vaults (05a01e6)
• Drop Kernel's origin gate from 1Password fill (7d574cd)
• Let customers keep refreshing imported Link wallet grants (49af4e9)
• Pass through tool_page_unloaded and disable SDK retries for WebMCP invoke failures (15c227b)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
Vault card and Link wallet token models change payment and OAuth integration contracts; WebMCP failure codes and retry semantics affect client error handling.

Overview
Release 0.140.0 bumps @onkernel/sdk and documents four API-facing feature areas in generated types and docs.

Vault Kernel cards gain single-use cards: create via single_use_card on KernelCardVaultItemSpec (mutually exclusive with payment_method_id), optional expires_at, KernelSingleUseCard / SingleUseCardBillingAddress types, and KernelCardState.source (payment_method | single_use_card) with updated fill/domain behavior in comments.

Link imported wallets support token_refresh (kernel vs customer) on wallet authorization and import specs; update_access_token is a new vault item operation (UpdateAccessTokenVaultItemOperationRequest), with import refresh_token now optional when the customer keeps refreshing grants.

1Password fill docs drop Kernel’s origin gate—the extension decides page match—and clarify when entry_id is required.

WebMCP invoke adds failure code tool_page_unloaded, documents X-Should-Retry: false for non-retriable failures, and raises documented tool input size limit from 1 MiB to 4 MiB.

Separately, the Update MCP Coverage workflow and agent prompt now diff the SDK from origin/main’s pinned version, include src/client.ts and src/lib in audits, and require coverage reports to describe the full branch diff, with guidance that OpenAPI is for descriptions only—not capabilities beyond what the SDK exposes.

^{Reviewed by Cursor Bugbot for commit c6ba558. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a8a321d. Configure here.}

[cursor]

Single-use card type omits details

High Severity

KernelSingleUseCard only accepts optional reference, so callers cannot supply the card details the create path is documented to take. SingleUseCardBillingAddress is generated and exported but never attached to that type, so number, expiry, CVC, name, and billing address cannot be typed on single_use_card. The new vault card flow cannot be used through the public SDK types.

Additional Locations (1)

• src/resources/vaults/items.ts#L3139-L3155

 

^{Reviewed by Cursor Bugbot for commit a8a321d. Configure here.}

[rgarcia]

Changelog checked against the API PRs merged since the last release (#5231, #5205, #5209 and the WebMCP invoke change); all four SDK-affecting changes are listed.

[kernel-internal]

🤖 Release is at https://github.com/kernel/kernel-node-sdk/releases/tag/v0.140.0 🌻