Update SDK to 0.112.0 and add custom WebMCP actions

[rgarcia]

Summary

• Pin @onkernel/sdk to 0.112.0 using Bun and update the lockfile. The full TypeScript check found no additional SDK compatibility breaks.
• Update WebMCP descriptions and typed fixtures for nested tool metadata, camelCase schemas and annotations, custom source information, and exclude_custom. Preserve all invocation statuses, including awaiting_submission, without reshaping responses.
• Extend the existing webmcp action enum with list_custom, add_custom, and remove_custom. Validate namespaces, generated IDs, and the 8,000,000-byte UTF-8 source limit. Disable automatic retries for registration and retain no-retry invocation behavior.
• Document executable source, namespace replacement, untrusted metadata/output, and the difference between custom IDs and live tool references.

Validation

• bun test with the CI-pinned Bun 1.3.3: 744 passing tests after merging main, including 23 WebMCP tests covering forwarding, response preservation, validation boundaries, and API/transport errors.
• bunx tsc --noEmit --incremental false: passed across the repository.
• bun run build with Bun 1.3.3: passed with placeholder OAuth client IDs and a placeholder Clerk publishable key. The initial build without these variables stopped during page-data collection; compilation and type checking passed in both runs.
• Prettier on changed TypeScript, README, and package.json: passed. git diff --check: passed.
• bun run lint: blocked by the existing next lint script, which Next.js 16 no longer supports.
• bun run format:check: flags only the unchanged AGENTS.md.

Not tested: live Kernel API/browser execution, authenticated OAuth/Clerk flows, or production deployment. No generated application bundle changes are included.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Sep 24, 2026 8:23pm UTC

[masnwilliams]

The SDK migration and WebMCP coverage look good. Please disable automatic retries on custom-tool removal before merge: a successful DELETE with a lost response can be retried into a 404, reporting failure after the tool is gone. Also reconcile the MCP-facing 8 MB source limit with the hosted request-body limit; a note or smaller transport-specific limit is sufficient if large sources are not intended through this route.

[masnwilliams]

Correction to my earlier changes-requested review: I overstated the severity. The deletion retry and hosted source-size limit are valid edge cases/contract notes, but I do not consider either merge-blocking. My inline comments are updated accordingly. Approving the current head.