CLI: Update SDK to 2f367635f58ffca59a764f8a8280784fb0f9f7e7 and add new commands/flags

[kernel-internal]

This PR updates the Go SDK to 2f367635f58ffca59a764f8a8280784fb0f9f7e7 and adds CLI commands/flags for new SDK methods.

SDK Update

• Updated kernel-go-sdk to 2f367635f58ffca59a764f8a8280784fb0f9f7e7 (v0.119.0)
• The latest SDK change (73817c0 → 2f36763) is the v0.119.0 release and changes only release metadata: version, changelog, and README. api.md and the Go sources are unchanged, so this change adds no new methods or params.
• The previous SDK change (681b969 → 73817c0) adds the managed_auth credential vault item provider (ManagedAuthCredentialVaultItemSpecInputParam, ManagedAuthCredentialVaultItemSpec, ManagedAuthCredentialVaultItemState). It adds no new methods.

Coverage Analysis

This PR was generated by performing a full enumeration of SDK methods and CLI commands. All 172 SDK methods in api.md have CLI coverage, except the ConfigRegistry endpoints, which are marked x-cli-skip. kernel search (get/providers/contents) and kernel browsers curl cover the Search and Curl methods through raw requests.

New Commands

• None (no new SDK methods)

New Flags / Spec Options

• kernel vaults credentials create --spec-file now accepts {"provider":"managed_auth","connection_id":"...","description":"..."} for CredentialVaultItemSpecInputUnionParam.OfManagedAuth (ManagedAuthCredentialVaultItemSpecInputParam.ConnectionID, .Description). A missing connection_id is rejected before the request is sent.
• Display-safe vault JSON output keeps spec.connection_id and state.fields[*].type, and no longer rewrites managed_auth state fields with has_value. Table output shows the managed auth connection and a fill hint. The help text and README document the flow.

These came from earlier commits on this branch (SDK a1378239c479):

• --provider kernel on kernel vaults wallets create for WalletVaultItemSpecUnionParam.OfKernel (KernelWalletVaultItemSpecParam): Kernel-managed agentic network token wallet with hosted card enrollment. Provider config and --tokens-file are rejected for this provider.
• --provider kernel on kernel vaults cards create for CardVaultItemSpecUnionParam.OfKernel (KernelCardVaultItemSpecParam: wallet, amount, currency, merchant_name, merchant_url). cards update rejects Kernel cards because the API doesn't support updating them.
• --query on kernel vaults list for VaultListParams.Query.
• Spec help now documents KernelWalletSpec and KernelCardSpec.
• Item output shows the merchant URL, card last4, and network token last4 (masks.token_last4); filtered JSON output keeps token_last4.

Testing

• SDK bump to 2f36763: go build ./..., go vet ./... and go test ./... pass. This change adds no new commands or flags, so there was nothing new to smoke test.
• vaults credentials create with a managed_auth spec, run against the live API using an existing connection with a saved credential: the item was created ready with the fill operation advertised. items get (table and JSON) showed connection_id and the field binding types (email, password, sms_code), and items list showed provider managed_auth.
• Error paths: a missing connection_id is rejected client-side, and an unknown connection returns 404.
• Cleanup: deleted the item and the temporary vault, and confirmed the connection and its credential were unchanged.
• Unit tests added (cmd/vaults_managed_auth_test.go); go test ./... and go vet ./... pass.
• Earlier commits: vaults wallets create --provider kernel sent its request, but the staging API answered provider configuration is unavailable. vaults cards create --provider kernel reached the API, which validated the kernel card spec.

Triggered by: kernel/kernel-go-sdk@2f36763
Reviewer: @bmsaadat

🤖 Generated with Claude Code

---

Note

High Risk
Adds managed-auth credential binding, Kernel card/wallet flows, and webmcp_invoke with vaulted secrets and possible page side effects—all security- and payment-sensitive paths.

Overview
Bumps kernel-go-sdk to v0.119.0 and expands vault/credential CLI support for new API providers and operations.

Vault credentials can be created with managed_auth (connection_id + optional description): no stored values; fill reads the linked auth connection’s saved credential at runtime. Parsing, help, table/JSON output, and tests cover the new provider.

Vault items gain webmcp_invoke (--params / --spec-file): bind vaulted fields into a WebMCP tool call on a vault-bound browser session, with validation, no retries on uncertain outcomes, and status-based exit codes. Docs and README list it alongside fill / collect.

Kernel payment provider is wired for vaults wallets create and vaults cards create (--provider kernel); Kernel wallets reject provider config/tokens; cards update is blocked for Kernel items. Output/docs add merchant URL and card/network token last4 fields.

kernel vaults list adds --query (name substring / exact ID), preserved in pagination hints. kernel credentials table output shows TOTP algorithm/digits/period when configured. kernel logs only sends --since when the flag was explicitly set.

Unit tests cover WebMCP invoke, managed auth, Kernel wallet validation, vault list query, and TOTP algorithm normalization.

^{Reviewed by Cursor Bugbot for commit 21ce1a2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.116.0 ⏵ v0.119.0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dced2d6. Configure here.}