Add credential vault commands and preview CLI binaries by rgarcia · Pull Request #252 · kernel/cli

rgarcia · 2026-09-14T12:00:30Z

summary

Add credential create/update from bounded file/stdin JSON and collection operations using the public Go SDK v0.105.0. Share fill execution and strict outcome validation between card and credential items; accept --params or --spec-file, with type-specific field/URL/format validation.
Direct agents not to store, collect, or fill credit card data through credential items; use wallet and card item types instead. Include this steering in help, human-readable credential output, and the README. This is guidance, not PAN detection or rejection.
Make the flow discoverable through vaults, credentials, items, invoke, and browser help. Steer description toward the recognizable site name and usernames/emails toward explicit sensitive: false; document empty-string updates as clears. Preserve readiness/version metadata while omitting stored credential values. Redact credential write errors and disable SDK retries.
Adapt card PATCH to the typed SDK request without changing provider behavior.
Build Linux/macOS/Windows amd64/arm64 preview archives and checksums in Actions. No stable release, npm, or Homebrew publication. See PREVIEW.md for download instructions.

SDK dependency

Uses the public github.com/kernel/kernel-go-sdk v0.105.0 release. The temporary private SDK replacement and token setup are removed; fork tests and Go caching are enabled again. Request types are updated for the released SDK while preserving card PATCH and advertised-operation payloads.

Vault SDK coverage

Add prepare_checkout with strict checkout JSON validation, advertised-operation checks, optional approval-page opening, and no automatic retries.
Preserve preparation metadata and event IDs in safe JSON; display readiness and submission deadlines in human output.
Add --expected-item-id to credential updates alongside the required version precondition.
Cover initial values/TOTP, null and empty-string updates, replacement conflicts, preparation outcomes, redaction, and no-retry behavior with HTTP contract tests.
Reviewed vault changes from SDK 0.103 through 0.105. No managed-auth or WebMCP command changes.

validation

After the public SDK upgrade and vault additions: make test, targeted race tests, the local Linux build, and help inspection pass. The local six-platform build was blocked by disk space; CI preview builds pass for all six targets on the latest commit.
make test (vet and all repository tests): pass.
Vault/credential/browser-binding tests under the race detector: pass.
Local CLI build and help inspection: pass.
actionlint for changed workflows and bash syntax validation: pass.
SDK HTTP contract tests cover typed requests, null and empty-string clearing, collection URLs, both fill input modes/item types, credential fields named expiration, safe outcomes, redaction, and no retries. Subprocess tests verify valid JSON and exit status for credential and card outcomes.
CI tests, six-target preview builds, security checks, and Bugbot pass on c17fb9d. Live browser fill and live checkout preparation have not been exercised.

try the preview

Download the CI preview binaries (GitHub login required, 14-day retention). Includes Linux/macOS/Windows on amd64 and arm64. Extraction and API configuration instructions are in PREVIEW.md.

cursor

Stale Bugbot comment from a previous run.

socket-security · 2026-09-15T18:35:45Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/kernel/kernel-go-sdk@v0.102.0 ⏵ v0.105.0	⁺¹

View full report

kernel-internal · 2026-09-15T18:39:04Z

🔧 CI Fix Available

I've pushed a fix for the CI failure.

What failed: both test and build (Preview CLI binaries) failed at go mod download:

go: github.com/kernel/kernel-go-sdk@v0.102.0 (replaced by github.com/kernel/kernel-go-sdk-staging@v0.86.1-0.20260913234358-ea40d26657db): version "v0.86.1-0.20260913234358-ea40d26657db" invalid: unknown revision ea40d26657db

Root cause: the staging SDK revision pinned by the replace directive in go.mod is no longer resolvable. This is not a regression from the code in this PR — fd5a2ae passed yesterday with the same pin, and the latest commit only merged main without touching go.mod. The pinned revision has since disappeared from the staging repository.

The fix applies the transition that PREVIEW.md and the release workflow's "Reject preview SDK dependencies" guard already call for. The credential vault API is now in the released SDK, so the preview pin is no longer needed:

Dropped the kernel-go-sdk-staging replace directive and pinned the released github.com/kernel/kernel-go-sdk v0.104.0.
Updated the two vault item update call sites to the released union field names (OfCardVaultItemUpdateRequest, OfCredentialVaultItemUpdateRequest).
Set Type: "card" explicitly on the card update body, since in the released SDK that field is a plain string with omitzero rather than an elidable constant, matching the credential path which already sets its type.
Switched the authorize body to AuthorizeVaultItemOperationRequestParam, which made the shared/constant import unused.

make test (go vet + go test ./...) passes, and scripts/build-preview.sh cross-compiles cleanly for all six targets.

Total change is 4 files, +6/−9.

Worth noting as follow-up for you rather than something I changed: PREVIEW.md also asks to remove the temporary SDK-auth steps and restore fork testing and Go caching once the pin is gone. Those steps are harmless now that dependencies resolve publicly, so I left the workflows alone to keep this fix minimal.

👉 Click here to create a PR with the fix

cursor

Stale Bugbot comment from a previous run.

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6758ec9. Configure here.}

Update github.com/kernel/kernel-go-sdk to aac4d0c (v0.105.1-0.20260915195748-aac4d0c60651). The only API change is a new nullable `intent` response field on config-registry analyses, and every /config-registry endpoint carries x-cli-skip, so no command or flag changes were needed. A full enumeration of api.md against the CLI command tree found no other coverage gaps. Repair the fallout from merging main (#252, #253) into this branch. Git auto-merged two independent variants of the vault credential work into code that did not parse (an orphaned `case "credential":` after an `if`, a duplicate `preparation` map key) and into call sites that referenced functions from the other variant. Main's reviewed versions supersede the bot-authored drafts, so the vault subsystem is taken from main verbatim, along with its README sections. Branch-only work that main lacks is kept: auth connections login regained its dropped TelemetryCdpExclude input field, the `--interaction-id` submit flag stays documented, and the items invoke table row keeps its prepare_checkout/collect coverage. Tested: go build ./..., go test ./... (all green), plus live API smoke tests of vaults create, vaults credentials create/update --spec-file, vaults items get/get -o json/events/delete, vaults delete, browsers list, and auth connections login --telemetry-cdp-exclude validation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rgarcia added 6 commits September 14, 2026 12:00

Add credential vault commands and preview CLI builds

5b8db58

Preserve bounded fill error codes for agent diagnostics

62f73a0

Decode operation responses without retaining prior item state

07c6c18

Download preview artifacts directly into the documented directory

33e792b

Clarify preview-only SDK dependency before merge

c265642

Merge main and unify card and credential fill

f1e6a86

cursor Bot reviewed Sep 14, 2026

View reviewed changes

Comment thread cmd/vaults_output.go

Show credential-specific collection guidance

10828c2

rgarcia requested a review from hiroTamada September 14, 2026 16:06

Clarify credential naming and sensitivity guidance

b4a66ce

hiroTamada approved these changes Sep 14, 2026

View reviewed changes

rgarcia and others added 3 commits September 14, 2026 21:12

Steer credit card workflows away from credential items

fd5a2ae

Merge branch 'main' into hypeship/vault-credentials

9eaed37

Use the released Go SDK for credential vault commands

889ca87

cursor Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread cmd/vaults_operation_params.go

Cover released vault checkout and credential preconditions

6758ec9

cursor Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread cmd/vaults_output.go Outdated

Keep preparation URLs and input diagnostics usable

c17fb9d

rgarcia merged commit de979fc into main Sep 15, 2026
8 checks passed

rgarcia deleted the hypeship/vault-credentials branch September 15, 2026 19:10

kernel-internal Bot mentioned this pull request Sep 15, 2026

CLI: Update Go SDK to aac4d0c606518c16baad5e10687d99e1dd805ea4 #231

Open

Navigation Menu

Uh oh!

Add credential vault commands and preview CLI binaries - #252

Add credential vault commands and preview CLI binaries#252
rgarcia merged 13 commits into
mainfrom
hypeship/vault-credentials

rgarcia commented Sep 14, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

socket-security Bot commented Sep 15, 2026 •

edited

Loading

Uh oh!

kernel-internal Bot commented Sep 15, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

rgarcia commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

summary

SDK dependency

Vault SDK coverage

validation

try the preview

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

socket-security Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kernel-internal Bot commented Sep 15, 2026

🔧 CI Fix Available

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rgarcia commented Sep 14, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

socket-security Bot commented Sep 15, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading