[kernel-internal]

Automated Release PR

0.133.0 (2026-10-28)

Features

• Forward Idempotency-Key on playwright and REPL execution (6a0b6b5)
• Select 1Password fill pages by target and return stored-token grants (1d60d43)
• Support multiple Kernel wallet payment methods and payment requests (e338fed)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
Large generated vault/payment surface mirrors API contract changes (funding and wallet operations), and the MCP publish workflow now manipulates git history with new invariants—both warrant careful review but are mostly typings plus CI hardening.

Overview
Release 0.133.0 bumps package version, changelog, and API docs alongside generated TypeScript for new vault and browser behavior.

Vault and payments: Adds payment_request items (Link/Kernel wallet–parented purchases), KernelPaymentRequestVaultItemSpec, and wallet operations add_payment_method / remove_payment_method with matching request/result types. Kernel card state and specs gain payment_method_id and funding_status; VaultPaymentMethod expands with enrollment/removal status, action URLs, and optional capture_token. Docs steer checkout away from credential items toward wallet, payment_request, and card types.

1Password: 1pw_fill accepts optional target_id to pick a page when several match page_url. Ready credentials with customer-supplied tokens can expose granted logins in access_request.resolved.

Client: Sets idempotencyHeader to Idempotency-Key so mutating calls (including Playwright/REPL execution) can send per-request idempotency keys; adds a skipped idempotency integration test.

MCP coverage CI: The update workflow snapshots agent diffs from agent_base (not main) and the publish job rebuilds the update branch from the validated head when rebased, checking agent_base_tree before git apply so human commits on mcp-coverage-update are not dropped. Security tests assert the new flow.

^{Reviewed by Cursor Bugbot for commit ab7e64a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rgarcia]

Changelog matches the three SDK-affecting API PRs merged since 0.132.0 (kernel/kernel#4761, #5031, #5051). Generated 1Password target_id and access_request.resolved types match the spec.

[kernel-internal]

🤖 Release is at https://github.com/kernel/kernel-node-sdk/releases/tag/v0.133.0 🌻