[kernel-internal]

Summary

• Update the Go SDK to v0.144.0.

Coverage

CLI coverage update for Kernel Go SDK v0.144.0

Summary

• Updated github.com/kernel/kernel-go-sdk from v0.142.0 to v0.144.0 in go.mod and go.sum.
• Added --enrollment hosted|server to kernel vaults items invoke <vault> <key> add_payment_method.
  • Omitting the flag preserves the API default, hosted.
  • hosted sends the SDK's hosted-enrollment value and returns a cardholder card_enrollment action.
  • server sends the SDK's server-enrollment value and returns an issuer-backend card_ingest action when the organization's card backend is configured.
  • Invalid values and use with other operations fail before an API request.
• Updated payment-method output for the new server-enrollment response shape:
  • Safe JSON output now preserves public issuer_reference and valid_until fields.
  • Human-readable payment-method tables show those fields when present.
  • Human guidance distinguishes 30-minute cardholder enrollment links from 5-minute issuer ingest URLs.
  • Secret capture_token and unknown provider fields remain intentionally omitted.
• Added tests for default, explicit hosted, and server request serialization; validation; server-specific guidance; and the new public response fields.

SDK and CLI coverage review

A complete enumeration found:

• 178 SDK methods in api.md.
• 6 SDK methods excluded because their Config Registry operations have x-cli-skip: true.
• 172 SDK methods requiring CLI coverage, all mapped to existing CLI commands.
• 238 CLI command nodes enumerated with their flags.

No missing CLI commands were found.

The v0.142.0 to v0.144.0 SDK diff added two request fields relevant to CLI input:

1. AddPaymentMethodVaultItemOperationRequestParam.Enrollment
   • Previously missing.
   • Now exposed as --enrollment on kernel vaults items invoke ... add_payment_method.
2. VgsCardVaultItemSpecParam.CardMode
   • Already covered before this update through the protected JSON supplied to kernel vaults cards create --spec-file as card_mode.
   • Existing help and tests already cover full and cvc_only, including the conditional VGS card fields.

Help text synchronized with the API specification

Updated CLI help and runtime guidance to follow:

• AddPaymentMethodVaultItemOperationRequest.enrollment
  • Documents accepted values, the hosted default, 30-minute hosted expiry, 5-minute server expiry, and the server-configuration caveat.
• AddPaymentMethodVaultItemOperationResult
  • Distinguishes a cardholder card_enrollment action from an issuer-posted card_ingest action.
• VaultPaymentMethod.action, issuer_reference, and valid_until
  • Describes and displays the server-enrollment lifecycle in CLI terms.

The changed VGS card_mode and conditional card-field descriptions were reviewed; the existing CLI help already reflects the new specification, so no additional VGS help changes were needed.

Intentional exclusions

• Config Registry commands were not added because all six corresponding SDK operations are marked x-cli-skip: true.
• /vault/card-ingest/{payment_method_id} was not added as a command. It is marked x-cli-skip: true and x-stainless-skip: true; the card issuer calls the one-time action URL returned by add_payment_method --enrollment server.
• VGS card aliases and card_mode remain in --spec-file rather than separate shell flags so protected aliases are not placed in command-line arguments.

Validation

• go test ./... — passed.
• go test ./cmd -count=1 — passed.
• go build ./... — passed.
• Built /home/runner/work/_temp/cli-scratch/kernel from ./cmd/kernel — passed.
• Real API smoke test — passed:
  • Created an isolated vault and connected Kernel wallet.
  • Verified add_payment_method was advertised.
  • Invoked it with explicit --enrollment hosted.
  • Verified a pending enrollment with a card_enrollment action was returned.
  • Queried vaults wallets payment-methods and verified the newly created pending method and action were present.
  • Deleted the test vault and all created items.
• Server request serialization and card_ingest output/guidance were validated with unit tests. A real card-ingest submission was not attempted because it requires issuer card data and an organization-configured card backend.

Validation

• Go build
• Go vet
• Go tests

---

Note

Medium Risk
Changes payment-card enrollment request shape and operator guidance; mistakes could send ingest URLs to cardholders or miss new lifecycle fields, though validation is local and defaults preserve hosted behavior.

Overview
Updates github.com/kernel/kernel-go-sdk to v0.144.0 and exposes KERNEL wallet add_payment_method enrollment choice via --enrollment hosted|server on vaults items invoke. Hosted (default when omitted) maps to cardholder card_enrollment links; server sends issuer-backend card_ingest and is validated locally before the API call.

add_payment_method no longer accepts --params / --spec-file; enrollment is flag-only. Help, examples, and runtime messaging now distinguish 30-minute hosted links from 5-minute ingest URLs and when each audience applies.

Payment-method display adds public issuer_reference and valid_until when present, with human output branching on card_ingest vs card_enrollment. Tests cover default, explicit hosted, server serialization, validation, and the new fields. Minor copy normalizes url/json casing in several vault error strings.

^{Reviewed by Cursor Bugbot for commit 460b4eb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.142.0 ⏵ v0.144.0	+1

View full report

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 9b31519. Configure here.}